Add missing `TaskGroup.contact` attribute
Fix tests for non-`ggrc.models` models
Whitespace and spelling cleanup
Minor refactor to make Role Implications cleaner
Add hooks, roles, and migrations for Workflow Permissions

* Adds WorkflowOwner, WorkflowMember, BasicWorkflowReader, and
  WorkflowBasicReader roles (the last two are implied roles)
* Adds Workflow lifecycle hooks to create and use a separate context for
  each workflow
* Adds Context- and Role- Implications to ensure users have access to
  read the correct objects
* Add migrations to add roles and convert existing workflows (but does
  not include a "down" migration
Add needed abstraction violations for UI to handle roles

* Add new `workflows/contacts.mustache` to show WorkflowOwner users in
  info widget
* Add "context" and "authorization" mappings for UserRole modal
* Add "created" listener for WorkflowPerson to refresh the Context
  object (to force update of mappings)
Fix notifications for WorkflowOwner changes
Fixes around RBAC for CycleTaskEntry

* Ensure CycleTaskEntry is added to the correct context
* Add permissions for Document- and GDrive-related objects in Workflow
  contexts
Remove poorly place permissions restrictions
Enable overriding reference model for Cacheable mappings

* When `is_allowed_to_map` helper encounters a polymorphic target (e.g.,
  multiple possible target types), `Cacheable` is used as the
  placeholder model name.  Previously, `Relationship` model was used to
  check permission to map.  Now, other models can be used by defining
  `_canonical` mappings to `Cacheable`.
Revert to simple mapping for Workflow Tasks widget

* Otherwise, `unmap` doesn't work as expected.
Ensure correct `context` is set when creating TaskGroups
Merge pull request #1575 from reciprocity/feature/workflow-permissions

Initial introduction of permission restrictions on Workflow