Wrap all REST API requests in a transaction.

Early intention of the API was that a request would either succeed or fail, and
not partially make it to the database. This has either been lost over time or
was never working in the first place.

Guice's @Transactional annotation will no-op if a transaction is already
opened, thus the best way to get this behaviour is to ensure all REST api
methods are wrapped in @Transactional giving us one transaction per request,
and no way for a request to partially succeed.
Add support for non-transactional API methods.

Import specifically needs to record an import failure despite an error
performing the import.
Fix bug with listing users roles.

Automatic transactions for REST API calls exposed a bug here where we were
manipulating a Role object fetches from the database to hide visibility of
other users. This change would now end up in the db clobbering whatever other
users were using the role.

Fixed by copying data onto a detached object instead of modifying a live
Hibernate model.
Allow NonTransactional on classes as well to match Transactional.
Merge pull request #707 from candlepin/dgoodwin/request-transactions

Request Transactions