Add per-client-label access control customization and UI access

When deploying to multiple network segments or organizations it would be useful to have restricted UI views like:
- _Health-only access to label X_. This gives people deploying GRR clients in that organization a way to check that the deployment was successful, client versions are up-to-date, etc. without having any ability to task the GRR agents or see how they are being used.
- _Read-only access to label X_. Read-only view of everything the agents are doing: hunts and flows. Can be used to allay concerns about how GRR will be used, and the associated performance impact.
- _Full access for client label X_. Give a user full access to run flows and hunts on clients labelled X and Y. No access or visibility of other clients. This could be useful if the organization has their own IR team and wants to be able to use GRR but outsource the deployment and maintenance.

There's a reasonable amount of complexity in this and probably some more granularity required. I'm filing as a feature enhancement for now to gauge interest. People should chime in if this functionality is important to them.