Add layer-enabling substitution params

This PR uses the recent possibility (with C2C-built mapserver) to use runtime substitution variables in METADATA. As a result it is for instance possible to hide a protected layer from the GetCapabilities response by adding the following configuration in the LAYER definition (mapfile):

```
NAME "somelayername"
METADATA
    "ows_enable_request" "%s_enable_somelayername%"
END
VALIDATION
    "s_enable_somelayername" "^[a-zA-Z\!\*, ]*$"
    "default_s_enable_somelayername" "!*"
END
``` 
=> by default the layer "somelayername" cannot be requested (GetCapabilities, GetMap, GetFeature, etc.).

When a user is authenticated, the mapserver proxy will retrieve the list of layernames available to the user (using joins between roles/restricted areas/layers) and automatically adds matching runtime substitution variables with value "** to the query string. In the example above: ``s_enable_somelayername=*``

The join query is inspired by the code in entry view:
https://github.com/camptocamp/c2cgeoportal/blob/1.4/c2cgeoportal/views/entry.py#L129-L137

The retrieved list of layers may contain mapserver groups instead of layers.

For requests that have a LAYERS param, an intersection is made with the list of layers available to the current role, in order to avoid adding useless parameters in the requests.
Note that if a large number of protected layers are available to the user, the resulting URL may grow too big and hit URL size limit...

Changes have also be done in the "entry" view because it sometimes perform getcapabilities, for instance for building the themes list. Then we need to provide the available protected layers list as well. A "role_id" parameter has been added to the concerned function so that different versions of the getcapabilities are cached depending on the user's role.