add :read and :read_sis permissions on pseudonym

fixes CNVS-16482

test-plan:
 * given
   - Sally who's an admin with the :manage_user_logins permission on one
     account (Account1) and a student on another account (Account2)
   - Bob who's a student on both accounts
   - Bob's pseudonym in Account1 has a SIS ID set

 * as Sally:
   - GET /api/v1/users/x/logins
   - returned json should include sis_user_id field

 * as Bob:
   - GET /api/v1/users/x/logins
   - returned json should not include sis_user_id field

 * also, Sally should:
   - see Bob's Account1 pseudonym at /users/:bob
   - not see Bob's Account2 pseudonym at /users/:bob

Change-Id: Ie9fb65bd58a1fcd8aebc5e8f6c86c614e97ee9ca
Reviewed-on: https://gerrit.instructure.com/42908
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Nick Cloward <ncloward@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>