Include @webapi_response_errors for extension resource methods.

These methods were missing annotations about what errors they returned.

Testing done: Ran unit tests.

Reviewed at https://reviews.reviewboard.org/r/5663/
Add a function for returning the appropriate "no access" API error code.

We had several places in WebAPIResource that calculated the proper error
code to use for indicating that access isn't allowed for a resource.
Consumers then had to repeat that logic, which was silly and pointless.

This introduces a function, get_no_access_error(), that performs the
calculation.

Reviewed at https://reviews.reviewboard.org/r/5671/