Change dashboard-editor permission to dashboard

`dashboard` is what's used in Stagecraft and specified in our
documentation, so it's what we should use here.
[#73958524] Add a create dashboard route

This page will contain a form to allow creating dashboards.
Don't escape HTML in flashes

Flashes will need some care and attention, because they can now
contain arbitrary HTML.

This is so that we can provide nicely formatted error messages.
Add Flask-WTF, protect the app from CSRF attacks

We need to worry about CSRF because this application contains forms
that can be exploited by an attacker.

Retroactively apply CSRF protection to the upload endpoints.
Implement dashboard creation form

This commit introduces a form that will POST to Stagecraft to
create a dashboard.

It makes use of the session to store the form if it fails validation,
and then presents it back to the user.