Moved has_course_access from CMS to student.auth (common)

has_course_access is business logic that conveys information that's true across both the LMS and CMS: It returns whether or not a given user has access to all of the content in a given course by checking the user's role.

It would be useful to have this in common; e.g., for a shared course publishing API or the like, so I placed it below has_access in student.auth.