Add hooks, roles, and migrations for Workflow Permissions

* Adds WorkflowOwner, WorkflowMember, BasicWorkflowReader, and
  WorkflowBasicReader roles (the last two are implied roles)
* Adds Workflow lifecycle hooks to create and use a separate context for
  each workflow
* Adds Context- and Role- Implications to ensure users have access to
  read the correct objects
* Add migrations to add roles and convert existing workflows (but does
  not include a "down" migration
Add needed abstraction violations for UI to handle roles

* Add new `workflows/contacts.mustache` to show WorkflowOwner users in
  info widget
* Add "context" and "authorization" mappings for UserRole modal
* Add "created" listener for WorkflowPerson to refresh the Context
  object (to force update of mappings)
Fix notifications for WorkflowOwner changes