Content library permissions & collaboration (SOL-81)

**Title**: Content library permissions & collaboration (SOL-81)

**Background**: This PR adds a new page to studio where the user can manage who else has permission to access a content library. This PR also introduces a **new read-only role** used only for libraries.

**Jira tickets**: [SOL-81](https://openedx.atlassian.net/browse/SOL-81)

**Discussions**: Various offline discussions and the internal PRs below.

**Dependencies**: None - all dependencies are already merged to the feature branch.

**Sandbox URL**: CMS http://sandbox4.opencraft.com:18010/ - LMS http://sandbox4.opencraft.com/

**Internal code reviews PRs** https://github.com/open-craft/edx-platform/pull/8 https://github.com/open-craft/edx-platform/pull/11

**Partner information**: 3rd party-hosted open edX instance, for an edX solutions client.

**Author concerns**: Studio's roles ("Instructor", "Staff") are vague (is there any documentation in the code?) and with a third role in the mix ("User"), it was unclear which roles were allowed to do what, so I added the concept of permissions (EDIT_ROLES, VIEW_USERS, EDIT_CONTENT, VIEW_CONTENT) defined via roles... Would like feedback on this approach.
It's correct. The code inside the `for` loop only partially applies when `new_role=None`, but the part that does apply (building `old_roles` so we can remove the user from any roles they currently have assigned) is necessary.