Implement general user management: rework SSO

[zanerock]

Overview

Goals for general user management:

• Allow for 3 levels of access:
  1. Cloudsite admins : can do anything; generally these use API access keys and go through the root account
  2. Cloudsite site managers: can do anything except create users and setup
  3. Cloudsite content managers : can access and update content for any site
• In the future, we will support site-specific site and content managers (#235)
• Each global and site specific grouping creates a group, policy, and permission set
• A single site manager account is created as part of the setup
• Get away from default name of user accounts.
• Require specific group names as specified above

Deliverables

• [x] add permissions command group
• [x] create permissions sso command group
• [x] configure-sso becomes permissions sso create which walks through updated wizard
• [x] move SSO related data into permissions.sso field
• [x] update SSO wizard to follow new protocol
  • global group and policy names are locked in
  • user is the self
  • use 'AdministratorAccess' for admin user account
  • update IAM Policy to allow S3 upload + download plus everything needed by 'import'

[zanerock]

Work for this issue will begin begin on branch work-liquid-labs/cloudsite/231.