Manually perform permisssion lookups on FeedShelfView to ensure that users with object-level permissions appropriately pass validation (necessary for bug 1100554).

This is necessary because DRF will never run object-level permissions checks (i.e. has_object_permission) if the user fails the top-level checks (i.e. has_permission). There are valid use cases here where a user could pass has_object_permission but not has_permission.

To bypass this, we perform the validation checks in the viewset rather than in permission classes. This is unfortunate, but necessary.

r? @ngokevin @diox @robhudson
I always comes as a string from the querystring, but we don't accept IDs there, only slugs. Conversely in  `require_object_permission`, we get it off the object itself, where it is an integer.