CLC-4070 CLC-4100 Centralize CalCentral authorization

https://jira.ets.berkeley.edu/jira/browse/CLC-4070
https://jira.ets.berkeley.edu/jira/browse/CLC-4100

This attempts to unify our current authorization checks in a way that will be fairly easy to build on, abstracting low-level user-record details into a controller-and-Pundit-friendly spot.

There are still a number of places where authorization checks happen below controller code, and so the "current_user" object can also be embedded in models. Much more dangerously, it can be mimicked by them (Canvas::CourseProvision is an example). I hope we can discourage that, though.
D'oh! This comment refers to the AuthenticationStatePolicy (and appears there in its proper place). This copy is debris from code relocation. I'll remove it.