Manually perform permisssion lookups on FeedShelfView to ensure that users with object-level permissions appropriately pass validation (necessary for bug 1100554).

This is necessary because DRF will never run object-level permissions checks (i.e. has_object_permission) if the user fails the top-level checks (i.e. has_permission). There are valid use cases here where a user could pass has_object_permission but not has_permission.

To bypass this, we perform the validation checks in the viewset rather than in permission classes. This is unfortunate, but necessary.

r? @ngokevin @diox @robhudson
Curious why we don't just call them `carrier_id` and `region_id` and require them to be IDs?