Embargo functionality

* Allows publications to be set under an embargo using the `underEmbargo` and `embargoDate` fields
 * When a new publication is created `underEmbargo` defaults to `true` and `embargoDate` to `null`
* Moved the publication validation functionality from the `oae-tickets` to the `oae-publication` module
* Allows publication funders and authors to be updated through the `updatePublication` endpoint
* Augments a publication with user permissions when a publication is fetched e.g. `isAdmin`, `isAuthor`, etc

A UI counterpart PR is in the making.
Although this is code is safe, the build is complaining about the use of eval(): https://travis-ci.org/CUL-DigitalServices/avocet-hilary/builds/29584968

Consider something like this:
```
req.body.publication.underEmbargo = underEmbargo === 'true' ? true : underEmbargo === 'false' ? false : underEmbargo;
```