Code Injection PR 3489 rebased and updated

This is the code injection PR, rebased on master and updated with the latest and greatest.

Works for admins & owners if `codeInjectionUI: true` is set in config.js

**Note:** this also comes with an update to the settings pane to ensure that the about, labs and other navigation options are only available to users with the correct permissions.