CLC-4070 CLC-4100 Centralize CalCentral authorization

https://jira.ets.berkeley.edu/jira/browse/CLC-4070
https://jira.ets.berkeley.edu/jira/browse/CLC-4100

This attempts to unify our current authorization checks in a way that will be fairly easy to build on, abstracting low-level user-record details into a controller-and-Pundit-friendly spot.

There are still a number of places where authorization checks happen below controller code, and so the "current_user" object can also be embedded in models. Much more dangerously, it can be mimicked by them (Canvas::CourseProvision is an example). I hope we can discourage that, though.
OK, I buy your argument that AuthenticationState and AuthenticationStatePolicy need to be in a generic place, and that User is too specific. The problem is that these are not models. They're policy metadata that applies to models (or that can be mixed in to models later). They depend on some stuff in models, though, so they can't go in /lib. 

What about moving them to /app/policies (new top-level module) for future generic reuse?