CLC-4070 CLC-4100 Centralize CalCentral authorization

https://jira.ets.berkeley.edu/jira/browse/CLC-4070
https://jira.ets.berkeley.edu/jira/browse/CLC-4100

This attempts to unify our current authorization checks in a way that will be fairly easy to build on, abstracting low-level user-record details into a controller-and-Pundit-friendly spot.

There are still a number of places where authorization checks happen below controller code, and so the "current_user" object can also be embedded in models. Much more dangerously, it can be mimicked by them (Canvas::CourseProvision is an example). I hope we can discourage that, though.
{{/app/policies}} is the code convention that Pundit recommends -- I'll give that a shot & then update this PR.