access: Holding Pen role

* Adds Holding Pen role and authorization linked to the
  viewholdingpen action in workflows module.

Signed-off-by: Jan Aage Lavik <jan.age.lavik@cern.ch>