Check user role on collection and deck actions

This PR adds basic permission checking to actions on collections, decks, and cards that should be limited to instructors and admins. It checks that the user has the specified role and raises a `PermissionDenied` exception if they do not pass the check.

@jazahn Can you review when you get a chance? This is for FLASH-75.