Add a function for returning the appropriate "no access" API error code.

We had several places in WebAPIResource that calculated the proper error
code to use for indicating that access isn't allowed for a resource.
Consumers then had to repeat that logic, which was silly and pointless.

This introduces a function, get_no_access_error(), that performs the
calculation.

Reviewed at https://reviews.reviewboard.org/r/5671/