QA special roles

[florianm]

write tests to check for special roles:

• permissions (can update SPP?)
• notifications (part of SPP reviewers?)
• portfolio (can see SPP in review?)

update documentation

[florianm]

tricky one.

• pythia.documents.utils > grant_special_role_permissions grants "documents.change_projectplan" to all special roles BM, HC, AE, DM.
• pythia.documents.admin.ProjectPlanAdmin.get_readonly_fields restricts write privileges depending on superuser / special role (all fields rw), then approval status (if not approved, all rw except endorsements to team; if approved, all ro):
• Superusers and special roles can always edit.
• If document is not approved yet, and users has change permission, then the user can edit all fields except endorsements.
• Approved SPPs are read-only.
• All other cases, e.g. users without change permissions, default to DocumentAdmin.get_readonly_fields.

Note: SPP approval still a three step process with final approval by SVL.

[florianm]

added docs to http://sdis.readthedocs.io/specs.html#special-roles