CLC-3194 Part 1: Refactoring to use pundit library for authorization

https://jira.ets.berkeley.edu/jira/browse/CLC-3194

This is just part 1, it does not change the existing functionality. 

UserAuthPolicy is a new abstraction that encapsulates the rights that a particular user has. Those rights are persisted (as before) in the UserAuth model. UserAuthPolicy is fed to Pundit's convenience methods in controllers, e.g. by ApplicationController's clear_cache method. Some of the model layer uses the policy model more directly, e.g. as in CanvasCourseProvision. 

I made the list of permissions a little more granular than the JIRA specifies to give us future flexibility and a little more clarity. 

The next pull will add the new user types (Authors and View-As-ers).