This branch adds an authorizations (authz) framework to hubs.

I reviewed the existing authz libraries for Flask but most of them aren't being developed anymore, or impose their own user model and authentication system.

So I wrote one for Hubs, keeping in mind the possibility of re-using it in other apps if we need to. In its final stage, this authz system will have multiple backends to retrieve user roles, one of them being the CAIAPI that @puiterwijk is developing. I will also refactor it in an independant Flask extension that will be reusable in other apps, and make the permissions and roles lists configurable.

Since we want to have something working sooner rather than later, I started "small" by using the existing roles we have in hubs, as described by the Association model. Ideally, when CAIAPI is available, I'll just have to implement the connection to it and replace a couple methods.

The consequence of this multiple-steps process is that the reviewer may be wondering why it looks over-engineered. Aiming for larger than Hubs prevents from hardcoding a lot of things, but I believe it can be useful to other apps in our infra, as well as allowing us to change our authentication system (for example the different roles we have) without rewriting this module entirely.

The documentation for the authentication system is built with the usual tox -e docs command, feel free to have a look. As usual with my big pull requests, I've tried to keep the commits as topical and self-contained as possible, it will be easier to look at them in order rather than looking at the entire branch diff.