Maestro should have finer grained permissions

- [ ] This issue is blocking
- [ ] This issue is causing unreasonable pain

Maestro should have a fine grained permission system. read and write permissions should be distinct. Other ideas include some kind of confirmation step (essentially CR) for changes/build assignments, etc.

Basically, we want to solve the following problems:
- Anyone who can read Maesrtro today can do dependency changes
- There is limited auditing
- Dependency updates can be made in an arbitrary fashion (any channel -> any branch)