Maestro should have finer grained permissions

[mmitche]

• [ ] This issue is blocking
• [ ] This issue is causing unreasonable pain

Maestro should have a fine grained permission system. read and write permissions should be distinct. Other ideas include some kind of confirmation step (essentially CR) for changes/build assignments, etc.

Basically, we want to solve the following problems:

• Anyone who can read Maesrtro today can do dependency changes
• There is limited auditing
• Dependency updates can be made in an arbitrary fashion (any channel -> any branch)

[premun]

We should account for different roles when designing the new auth model then