Limit tool launches and tool visibility to users with staff roles

[ssciolla]

Students are currently not blocked in any way from using CAE, so the tool still launches, with some less than ideal behavior: a smaller subset of tools are listed and the add/remove buttons throw errors (as one would expect with OAuth implemented). Until we spend more time on handling the student role (#29), I think the most straightforward solution would be to block launches for any roles other instructor, admin, and sub-account admin. We may also want to limit tool visibility to “admins” for now.

TEST PLAN:

• Log in as a Canvas Admin, SubAccount Admin or course instructor, go to the course Settings->Navigation, and enable the Canvas App Explorer tool
• Verify that you can see the CAE tool on the left navigation, and successfully launch it
• Make a note of the navigation link URL for the tool. (e.g. courses/XXXXX/external_tools/XXXXX)
• Become student or log in as a student to this course, verify that the CAE tool is hidden for you in the left tool navigation.
• As a student, paste the navigation link URL in your browser's address bar and ensure that the tool shows an appropriate permission denied message.

[ziegler1960]

• Using Chrome Version 103.0.5060.53 (Official Build) (x86_64)
• Test course: https://canvas-test.it.umich.edu/courses/513255/
• Visually verified that CAE is on the course nav bar.
• Clicking on the link successfully launched CAE. URL for CAE is https://canvas-test.it.umich.edu/courses/513255/external_tools/45509
• Used Canvas Act as User function to become Studentd Test in Canvas Test.
• As Studentd Test, went to the test course. Did not see CAE on the course nav menu.
• Remaining on the course, I stopped acting as user and reverted to Teacher. I could again see CAE on the nav menu.
• Using Firefox 102.0.1esr (64-bit), logged into Canvas test as student Joe User and went to the test site.
• Was denied access to the course, as Students aren't allowed to access the Test instance (stupid, stupid Canvas people!).
• Changed Joe User's role to Teacher - tool launched and Joe authorized the app.
• Added Joe User as Student to a second test course with CAE installed.
• As Joe User in Firefox, accepted the invitation to the new course but could not access the course, getting instead an 'Access Denied' message (see note above and add an additional 'stupid').
• In Chrome, as myself (Teacher), Acted as User for Joe. Was unable to see CAE on the nav menu.
• Repeated that test on the first test course. Joe was unable to see CAE on the nav menu.
• In Firefox, as Joe (Student) was unable to access the course by pasting the URL of the first test course into the browser address bar, again Access Denied
• I'm going to mark this one as 'Passed' because, to the ability that I am able to test, it appears that a person on a course in the Student role cannot see or access CAE on that course.
• Due to the inherent limitations of the Canvas Test environment, I recommend that, after release, further and more complete testing be done in the prod environment to ensure that there are no surprises in terms of unexpected Student access to CAE.