Add and apply custom ViewSet classes

[jwalz]

What:

Adding custom ViewSet classes to better control the methods generated/exposed by the routers. The two new view set classes are:

RetrieveOnlyViewSet:
Supports GET requests to urls like addons.osf.io/v1/{resource-type}/{pk}

RetrieveWriteViewSet:
Supports GET/PATCH/DELETE requests to urls like addons.osf.io/v1/{resource-type}/{pk}
Supports POST requests to urls like addons.osf.io/v1/{resource-type}/

Notably, neither class supports GET requests to urls like addons.osf.io/v1/{resource-type}/

Why:

Of our top-level entities, only ExternalStorageService supports a List View (all of our other supported List Views are relationship views). Meanwhile, existing, out-of-the-box ViewSets from DRF and DRF-JSON API all provide both retrieve AND list functionality.

How:

• Create custom ViewSets mimicking the DRF-JSON API definitions here using only the appropriate mixins from DRF.
• Update the base classes for our ViewSets to inherit the correct new ViewSets.

Future Steps

• Determine the best path for allowing the OSF to disable users (either by adapting a new ViewSet that allows GET+PATCH behavior, a custom action on the UserReferenceModelViewSet, or via shared task queue)
• Implement selection of appropriate permission by action as per the DRF Docs

[brianjgeiger]

Very nice.