App Permissions from package.json

Progress on #2095 and #2059

- Add new AppPermissions class with read() method
- has default permissions to read and browse posts
- uses default permissions if no package.json
- uses default permissions if no ghost object in package.json
- uses default permissions when reading malformed package.json
- uses ghost.permissions if found in package.json