Embargo functionality

* Allows publications to be set under an embargo using the `underEmbargo` and `embargoDate` fields
 * When a new publication is created `underEmbargo` defaults to `true` and `embargoDate` to `null`
* Moved the publication validation functionality from the `oae-tickets` to the `oae-publication` module
* Allows publication funders and authors to be updated through the `updatePublication` endpoint
* Augments a publication with user permissions when a publication is fetched e.g. `isAdmin`, `isAuthor`, etc

The UI counterpart can be found at https://github.com/CUL-DigitalServices/avocet-ui/pull/245
These ternary callback constructions give me the heebie-jeebies, I'd much prefer a simple
```javascript
if (noAccess) {
    return callback({'code': 401, 'msg': 'Only authorized users are allowed to request tickets');
}

return callback(null, tickets);
```