Fix Members permissions

[dave-mills]

This PR fixes #203:

• updated RoleSeeder to add the view portfolios to institutional members, and remove the maintain custom principles.
• Updated the AdditionalCriteriaCrudController to deny access to create/update/delete operations unless you have the maintain custom principles permission.
  • even though we were hiding the buttons on the main My Institution page, you could still click through to "View", then the edit + delete options were shown on that page. With this update, those buttons no longer show.

NOTE: This PR includes PR #210, because my local version started expecting the View Component class for x-help-text-link added in that PR. I recommend not reviewing this one until 210 is merged in, so then the changes made here will be much more clear.

ALSO NOTE: Institutional members can still 'delete' institutions in this version. That issue is fixed in #208.

[dan-tang-ssd]

I got latest code and execute RoleSeeder file.

Performed testing with positive result in local env. I think it is good to merge.

---

Screen shots for reference:

Login as institutional member

BEFORE this PR, no portfolio showed for institutional member

AFTER this PR, portfolios showed for institutional member, with "SHOW INITIATIVES" button only

AFTER this PR, Additional assessment criteria tab, it shows "VIEW" button only

---

Login as institutional admin

AFTER this PR, portfolios showed for institutional admin, with "SHOW INITIATIVES", "EDIT", "REMOVE" buttons

AFTER this PR, Additional assessment criteria tab, it shows "VIEW", "EDIT", "REMOVE" buttons