Implement more appropriate permissions on API ViewSets

Most of the ViewSet permissions use the `IsAuthenticated` permission to authorize access to the underlying models. Some of these models contain data that should only be available to internal application services (e.g. other service credentials) and some should only be visible to the current logged-in user. Some may even be public/anonymous (like workflow versions)

We'll need to make a pass over these views to use more appropriate permission classes