Add a feature flag to enable downtime for the app

This adds a feature flag in an initializer which, when enabled, returns
a 503 error page to all users who do not have the 'admin' permission.
This is to prevent users editing mappings while we are migrating the
database from MySQL to PostgreSQL, but will let us check that everything
is working correctly before re-enabling general access.

Since the check for the feature flag is in the ApplicationController,
nearly all of the app is protected by it. The exceptions to this are:

- the hosts API: it isn't a problem to leave this visible, so long as
  we disable the CDN configuration job (this step is already in our
  migration plan)
- the errors controller: we need to leave this visible so that it can
  serve the 503 page
- the users controller from gds-sso: this needs to be visible so that
  signon integration works as normal

Going down this route for managing downtime (rather than doing it at
the nginx level) relies on the app running at all times, but this
should be the case for us anyway.

We should merge this before the postgres-master branch is merged, and
deploy this change in advance of the planned downtime, with the feature
flag set to false. To start downtime, we can set the flag to true in
alphagov-deployment and re-deploy the same release tag. After migrating
the database across, deploying the move to PostgreSQL and checking that
all is well, we can revert the flag to false and re-deploy the latest
release tag.

Since our zero-downtime unicornherder leaves two batches of unicorns
running for a couple of minutes after a deploy, we may want to hard-restart
the app just after deploys changing the flag so that everyone sees
the 503 page (or the app coming back up) at the same time, to avoid
confusion.