CLC-4070 CLC-4100 Centralize CalCentral authorization

https://jira.ets.berkeley.edu/jira/browse/CLC-4070
https://jira.ets.berkeley.edu/jira/browse/CLC-4100

This attempts to unify our current authorization checks in a way that will be fairly easy to build on, abstracting low-level user-record details into a controller-and-Pundit-friendly spot.

There are still a number of places where authorization checks happen below controller code, and so the "current_user" object can also be embedded in models. Much more dangerously, it can be mimicked by them (Canvas::CourseProvision is an example). I hope we can discourage that, though.
It's wildly confusing to label what you expect to be an instance of AuthenticationState as "@user". Changing this variable name to @authentication_state would reduce the confusion.