More granular Lookit-wide permissions for Lookit staff/RAs

Nobody has claimed this yet.

**TL;DR**: Lookit-wide permissions other than superuser for study review, recruitment, etc.

**Narrative**:

As an undergrad RA helping to review studies, I should have access to all study details/preview (although not data, ability to delete anything, etc.). As a recruitment specialist or RA supporting recruitment efforts, I should have access to the participant analytics view but not individual study views. For security reasons, although Kim and Rico should technically retain superuser permissions if needed, their routine logins would ideally be through accounts that have slightly reduced permissions.

Broken out from #140.

**Implementation notes:**

Proposed new roles:

| | Lookit tech support | Lookit recruiter | Lookit reviewer | Lookit study manager | Lookit access manager | Lookit admin |
|---|---|---|---|---|---|--|
| Preview role for all studies | x | x | x | x | | x |
| Approve/reject studies | | | x | x | | x |
| Manager role for all studies | | | | x | | x |
| Full admin role for all studies | | | | | | x |
| Create/edit all labs | | | | | x | x |
| Lab manager for all labs | | | | | | x |
| View recruitment manager | | x | | | | x |

Start by reviewing the existing permission model in the Lookit API and the earlier issue #140. Use the proposed role matrix as the acceptance criteria: each role should have only the listed study, lab, recruitment, and administrative access, with tests demonstrating the permitted and restricted actions.

Written by the indexing model from the issue text.