Content library permissions & collaboration (SOL-81)

**Title**: Content library permissions & collaboration (SOL-81)

**Background**: This PR adds a new page to studio where the user can manage who else has permission to access a content library. This PR also introduces a **new read-only role** used only for libraries.

**Jira tickets**: [SOL-81](https://openedx.atlassian.net/browse/SOL-81)

**Discussions**: Various offline discussions and the internal PRs below.

**Dependencies**: None - all dependencies are already merged to the feature branch. Note: this PR will conflict with #6155, so whichever is merged second will need to be rebased.

**Sandbox URL**: CMS http://sandbox4.opencraft.com:18010/ - LMS http://sandbox4.opencraft.com/

**Internal code reviews PRs** https://github.com/open-craft/edx-platform/pull/8 https://github.com/open-craft/edx-platform/pull/11

**Partner information**: 3rd party-hosted open edX instance, for an edX solutions client.

**Author concerns**: Studio's roles ("Instructor", "Staff") are vague (is there any documentation in the code?) and with a third role in the mix ("User"), it was unclear which roles were allowed to do what, so I added the concept of permissions (EDIT_ROLES, VIEW_USERS, EDIT_CONTENT, VIEW_CONTENT) defined via roles... Would like feedback on this approach.
Any reason why we check id here vs. email (email is used for these checks above)? Can we be consistent and either always use id or always use email?