block.get_parent() and group access enforcement

@cpennington @dmitchell @andy-armstrong   I'm rebuilding the commits on my branch for ease of review.  The first implements the plumbing necessary for get_parent() to work.

Questions:
* smuggling `parent_url` inside the `cached_metadata` seems to work - but only some of the time.  Therefore an (extremely naive) just-in-time lookup is added as a fallback.  Sadly it seems `load_item` executes multiple times for the same block during the same modulestore lifecycle, therefore we have multiple objects in memory for the same block, but different identities (as evidenced by the need in tests to compare equality by blocks' locations instead of the blocks themselves).  Is this by design?  If not, is there any realistic way to address it without a major effort?  I don't yet feel comfortable enough making changes to this code to guess.
* I suspect that I should be testing get_parent with each modulestore implementation, is that right?
* Are the tests for get_parent (for any given modulestore) exhaustive enough?
`ItemFactory` perhaps should use `create_child` instead of its current pattern of:
1. `get_item` for the parent
2. `create_item`
3. `get_item` for the newly created thing (get rid of this and have step 2 set `module = store.create_item`
4. it then sets all the fields in the new item. It could instead pass `fields=kwargs.items()` and updates the store
5. then it adds the new item to the parent and updates the parent
6. then it gets the item one more time for good luck

It could simply be:
```
            module = store.create_child(
                user_id,
                parent.scope_ids.usage_id,
                location.block_type,
                block_id=location.block_id,
                metadata=metadata,
                definition_data=data,
                runtime=runtime,
                fields=kwargs.items(),
            )
```
and remove all the rest of the method other than the `static_tab` and 
```
    if publish_item:
                    store.publish(parent.location, user_id)
````