Content libraries permissions

This pull request implements more fine-grained permissions for content libraries.

There are three roles that users can have:
- **Instructor** ("Instructor" in LMS, "Admin" in studio): Can edit the library and its content, *and* can assign roles to other users.
- **Staff**: Can edit the library and its content.
- **LibraryUser**: New permission: read-only access to the library. Can use its content in other courses (and override settings when doing so), but cannot make any changes to the library itself nor its content.

**No UI** has yet been implemented for assigning these roles to users, but you can see the tests for how to do it from code. You can also test it out by assigning roles manually - just ensure the django admin site is enabled, then go to http://localhost:8001/admin/student/courseaccessrole/ and create entries with role of `library_user` or `staff` or `instructor` and `course` equal to the library's key.

**Note**: The permissions are currently not checked when the `refresh_children` method of `LibraryContentModule` does its thing. This will be implemented after the `Scope.settings` stuff is figured out (see #6), since it involved re-writing `refresh_children`.