WIP: implement group access enforcement in courseware

@andy-armstrong @cahrens 

@dmitchell @cpennington - FYI - some performance optimizations still being worked on in here, but would appreciate any feedback / guidance on the overall logic which isn't planned to change.
I wonder whether it would be better to write this as an `@lazy` attribute of an `XBlockMixin`. That way it would a) only be computed once per descriptor, b) could potentially just use `self.get_parent().merged_group_access`, if we fixed all modulestores to actually provide a parent id (thus obviating the DFS search above)