RoleAccess auditing/history functionality

[qqmyers]

What this PR does / why we need it: Tracks the history of all RoleAssignment changes on a dataset or file, making it easy to see when roles were assigned and by whom, whether a user has had permission on an item in the past, etc. The history of role assignments is available in the (JSF) UI and via API, e.g.

The API supports JSON and CSV outputs.

All three cases are handled: assignments on a collection, assignments on a dataset, assignments to one or more files in a dataset.

Which issue(s) this PR closes:

• Closes #

Special notes for your reviewer:

• At least through the UI, it looks like you can only assign the filedownloader role to files. The history mechanism should work if there are other roles possible.
• To simplify the display, granting access to multiple files will group all files where access is granted/revoked at the same time by the same user into one line in the display. Same time currently means within the same minute.
• Logging and displaying the history are controlled by a feature flag, the functionality is off by default.
• The download buttons in the UI use the API, requesting the CSV version via an Accept "text/csv" header. This required a) using a signedUrl to avoid requiring the experimental api-session-auth flag (this could be a general mechanism to allow the JSF UI to call the api as needed), and B) using Javascript to be able to send the header and write a file (versus just having a link to the raw URL - the browser would call that and show the json output on the screen instead of downloading csv).
• I created some IT tests (as well as local tests) - I don't know how to run them as part of the Jenkins build as they'd require the flag to be true (which I assume we don't want as the default).

Suggestions on how to test this: Turn on the flag, assign/revoke various roles, check that the history makes sense. The displays are ordered by revocation date (unrevoked first), then assignment date. Note that either the assign or revoke dates and assigner/revoker fields can be null - the revoked ones because the assignments are active, the assign one when the assignment was made before RA history functionality was turned on.

Does this PR introduce a user interface change? If mockups are available, please link/include them here: see image above.

Is there a release notes update needed for this change?: included

Additional documentation: API and UI docs included, feature flag documented.

[pdurbin]

I didn't test the code but API tests are passing (skipped for this new feature, since it's off by default) and I'm happy with how it looks. Approved.

[ofahimIQSS]

need an update here to resolve conflicts

[ofahimIQSS]

looks good to me - merging