Embargo functionality

* Allows publications to be set under an embargo using the `underEmbargo` and `embargoDate` fields
 * When a new publication is created `underEmbargo` defaults to `true` and `embargoDate` to `null`
* Moved the publication validation functionality from the `oae-tickets` to the `oae-publication` module
* Allows publication funders and authors to be updated through the `updatePublication` endpoint
* Augments a publication with user permissions when a publication is fetched e.g. `isAdmin`, `isAuthor`, etc

The UI counterpart can be found at https://github.com/CUL-DigitalServices/avocet-ui/pull/245
It'd be neat if this could be made configurable from the tenant config. Similar to default visibility for content items.