Content library permissions & collaboration (SOL-81)

**Title**: Content library permissions & collaboration (SOL-81)

**Background**: This PR adds a new page to studio where the user can manage who else has permission to access a content library. This PR also introduces a **new read-only role** used only for libraries.

**Jira tickets**: [SOL-81](https://openedx.atlassian.net/browse/SOL-81)

**Discussions**: Various offline discussions and the internal PRs below.

**Dependencies**: None - all dependencies are already merged to the feature branch.

**Sandbox URL**: CMS http://sandbox4.opencraft.com:18010/ - LMS http://sandbox4.opencraft.com/

**Internal code reviews PRs** https://github.com/open-craft/edx-platform/pull/8 https://github.com/open-craft/edx-platform/pull/11

**Partner information**: 3rd party-hosted open edX instance, for an edX solutions client.

**Author concerns**: Studio's roles ("Instructor", "Staff") are vague (is there any documentation in the code?) and with a third role in the mix ("User"), it was unclear which roles were allowed to do what, so I added the concept of permissions (EDIT_ROLES, VIEW_USERS, EDIT_CONTENT, VIEW_CONTENT) defined via roles... Would like feedback on this approach.
ID is preferred whenever possible because it's a faster and more robust comparison. However, the RESTful API uses email addresses to identify users, so at some points we don't know the user's ID yet and have to compare email addresses instead (which should be equivalent).

I could change to always use email, but I think it's better to use ID when possible.