Add RBAC to views #399

Adding RBAC to plugin views: https://docs.pulpproject.org/pulpcore/plugins/plugin-writer/concepts/index.html#role-based-access-control

Specific Permissions for PyPI views

From PyPI:

There are two possible roles for collaborators:

Maintainer
Can upload releases for a package. Cannot invite collaborators. Cannot delete files, releases, or the project.
Owner
Can upload releases. Can invite other collaborators. Can delete files, releases, or the entire project.

These permissions need to be added to distributions (our indexes) per project in the distribution and be auto assigned when uploading content to the index. Upon first time a package from a project is uploaded, that user becomes the owner of that project. Future package uploads for that project needs to have the owner or maintainer role. For content that is already present in the index or is added through pulp (syncing or content api) they will need to get a default owner (creator of the distribution seems like a good choice). These permission checks will only occur on the /legacy/ and POST /simple/ endpoints for now. All other PyPI apis will be available to view from unauthenticated users.