Fixed #22295 -- Replaced permission check for displaying user-tools

AdminSite currently requires users to have is_staff explicitly set in order to login, i.e. only staff members can login.
The way it is hardcoded in AdminSite and its templates makes it difficult to create custom AdminSites which allow certain non-staff members (e.g. with special permissions) to login.

With this PR, custom AdminSites only need to override has_permission and login_form to change the login requirements.

ticket  https://code.djangoproject.com/ticket/22295
(old https://code.djangoproject.com/ticket/24032)
to avoid hardcoding the string a second time: `permission = forms.PermissionAdminAuthenticationForm.permission`