2873: add /permissions API method

2873: add /permissions API method

The /permissions/:uuid method will return a list of all permissions that
the current user is allowed to see on the given uuid.

* New method LinksController::get_permissions, with a route from
  /arvados/v1/permissions.

* LinksController overrides find_object_by_uuid to permit looking up a
  uuid in any class, when called by get_permissions.

* Moved link permission checking to Link.ensure_owner_uuid_is_permitted.

* Use current_user.can? to check the user's permission on head_uuid.
  Removed unnecessary owns? and can_manage? code.

* Unit tests:

  * test/integration/permissions_test.rb: added tests:
    * "get_permissions returns list"
    * "get_permissions returns 404 for nonexistent uuid"
    * "get_permissions returns 403 if user lacks manage permission"

  * test/unit/link.rb: test that only permission and name links have
    their ownership changed upon save.

  * test/unit/permission_test.rb: test the following scenario: when user
    "active" owns a group G which can_manage another group H, then
    active user is permitted to create permission links directly on
    objects in group H.

Refs #2873.

2873: perms