ProfileAvatar doesn't specify permissions

[`ProfileAvatar`](/incuna/django-user-management/blob/v2.1.1/user_management/api/avatar/views.py#L12-L31) doesn't set `permission_classes`. This should use `IsAuthenticated` to avoid the possibility of misconfiguration.
The avatar will need to be gotten by unauthenticated users, so I think `IsAuthenticatedOrReadOnly ` is correct.