Content library permissions & collaboration (SOL-81)

**Title**: Content library permissions & collaboration (SOL-81)

**Background**: This PR adds a new page to studio where the user can manage who else has permission to access a content library. This PR also introduces a **new read-only role** used only for libraries.

**Jira tickets**: [SOL-81](https://openedx.atlassian.net/browse/SOL-81)

**Discussions**: Various offline discussions and the internal PRs below.

**Dependencies**: None - all dependencies are already merged to the feature branch. Note: this PR will conflict with #6155, so whichever is merged second will need to be rebased.

**Sandbox URL**: CMS http://sandbox4.opencraft.com:18010/ - LMS http://sandbox4.opencraft.com/

**Internal code reviews PRs** https://github.com/open-craft/edx-platform/pull/8 https://github.com/open-craft/edx-platform/pull/11

**Partner information**: 3rd party-hosted open edX instance, for an edX solutions client.

**Author concerns**: Studio's roles ("Instructor", "Staff") are vague (is there any documentation in the code?) and with a third role in the mix ("User"), it was unclear which roles were allowed to do what, so I added the concept of permissions (EDIT_ROLES, VIEW_USERS, EDIT_CONTENT, VIEW_CONTENT) defined via roles... Would like feedback on this approach.
Once the AJAX request completes successfully, it triggers a reload of the current page. The normal `wait_for_ajax` method sometimes fails in that case, since it gets a `jQuery is not defined` error if it tries to check the promise after the location.reload() has already triggered but before the new page has loaded.

I cannot just change `wait_for_ajax` as part of this PR, since it's part of an external repository ([edx/bok_choy](https://github.com/edx/bok-choy/)). I assume that getting a PR merged to that repo and updating the requirements in this one will delay this PR too much. It's also a fairly unusual circumstance that the page may be reloading immediately after an AJAX call - generally we try to avoid that in studio, though it's how the existing auth pages work.