REST requests should mirror Alyx user group permissions

Most (but maybe not all) REST views use permissions defined in alyx.base.BestRestPublicPermission: https://github.com/cortex-lab/alyx/blob/95c2e40de451f02b24e3b3de908a99e7ff513ec0/alyx/alyx/base.py#L648-L664, while most (but maybe not all) model admin instances use the alyx.base.BaseAdmin.has_change_permission method: https://github.com/cortex-lab/alyx/blob/95c2e40de451f02b24e3b3de908a99e7ff513ec0/alyx/alyx/base.py#L374-L413

This means that users have far more permissions when making REST queries than via the admin interface which is extremely insecure and confusing to users. Below are some suggested improvements:

• Ensure all REST views are using a shared base permissions set (i.e. permission_classes = rest_permission_classes() is present everywhere)
• Ensure all model admin classes use the same basic permissions system (i.e. super class call to BaseAdmin.has_change_permission)
• Consolidate base permissions between APIs (the above two methods can call a common base permissions function)
• Permit test Alyx to allow all REST permissions for testing purposes - check library tests still pass after changes
• Add method to BaseTests to check that REST API permissions are suitable. This can be a generic test for all apps.

Start by comparing alyx/base.py's BestRestPublicPermission, BaseAdmin.has_change_permission, and BaseTests with the REST views and model admin classes across the project. Run the library tests while auditing permission_classes and superclass calls. Done means the APIs and admin share the intended permission behavior, test Alyx remains usable for permission tests, and generic REST permission coverage passes.