Add operator shelf authorization, apply to relevant viewset, add command line tools for permissions management.

See the testing spec in the bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1074304#c1

r? @robhudson @ngokevin @diox
Suppose you could also use `Operators:*`, which we already seem to have. Or `OperatorDashboard:*`. The `*` to me means "sudo" in a sense and yet doesn't violate the `<verb>`. :smile: