2873: permission links are owned by root

Permission links are themselves "owned" by root. (Technically, the
owner_uuid on permission links will be ignored when determining a user's
permission to modify an object -- ensuring that it is always root
provides consistency, and helps to flush out any permission edge cases
early in testing.)

ArvadosModel.ensure_owner_uuid_is_permitted and
Link.permission_to_attach_to_objects grant permission to modify
permission links based on the user's relationship to the link's head.

New methods:
* User.owns? determines ownership of an object.
* User.can_manage? determines whether a user has permission to manage an object.
* ArvadosModel.has_permission? determines whether an object has been
  granted a particular permission on a specified target.

Refs #2873.
2873: add /permissions API method

The /permissions/:uuid method will return a list of all permissions that
the current user is allowed to see on the given uuid.

* New method LinksController::get_permissions, with a route from
  /arvados/v1/permissions.

* LinksController overrides find_object_by_uuid to permit looking up a
  uuid in any class, when called by get_permissions.

* Moved link permission checking to Link.ensure_owner_uuid_is_permitted.

* Use current_user.can? to check the user's permission on head_uuid.
  Removed unnecessary owns? and can_manage? code.

* Unit tests:

  * test/integration/permissions_test.rb: added tests:
    * "get_permissions returns list"
    * "get_permissions returns 404 for nonexistent uuid"
    * "get_permissions returns 403 if user lacks manage permission"

  * test/unit/link.rb: test that only permission and name links have
    their ownership changed upon save.

  * test/unit/permission_test.rb: test the following scenario: when user
    "active" owns a group G which can_manage another group H, then
    active user is permitted to create permission links directly on
    objects in group H.

Refs #2873.

2873: perms
2873: changes for code review

Incorporating code review comments:

* @Link#get_permissions@ uses @Link.where@ instead of @find_objects_for_index@; @find_object_for_uuid@ just populates @@object@ with the head_uuid object and leaves @@objects@ alone.
* @ArvadosModel.lookup_by_uuid@ renamed @ArvadosModel.find_by_uuid@ and punts to the superclass if called as a subclass method.
* Test @get_permissions_returns_list@ checks that the :active user can get permissions. Also uses the group fixtures for testing permissions instead of collections (because can_manage permissions only work so far on users and groups.

(refs #2873)
2873: more code review changes

* get_permissions sets @offset and @limit explicitly to ensure that
  render_list does the right thing.

* Tests updated to use permission links on Groups (permissions are not
  yet working for other objects)

* Added tests for "uuid exists but is unreadable" and "uuid is readable
  but not manageable"

Refs #2873.
Merge branch '2873-permission-links-ownership'

Closes #2873. Huzzah!