feat(rbac): add Role-Based Access Control to pulp_npm

[CryptoRodeo]

Enable fine-grained permission enforcement across all npm resources. Users can now be assigned creator, owner, or viewer roles on repositories, remotes, and distributions, with object-level scoping and cross-object permission checks.

fixes #387

📜 Checklist

• Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
• A changelog entry or entries has been added for any significant changes
• Follows the Pulp policy on AI Usage
• (For new features) - User documentation and test coverage has been added

See: Pull Request Walkthrough

[dkliban]

Updated review — all three issues from the original review have been addressed. CI is green.

Fixes verified

1. queryset_filtering_required_permission added to NpmPackageViewSet — content listing is now properly scoped by RBAC.

2. NpmPingView now uses permission_classes = [AccessPolicyFromDB] with authentication_classes = [] and principal: "*" — clean, consistent with how other plugins handle public endpoints. New test_ping_unauthenticated validates it with a raw HTTP request.

3. Content scoping test now syncs actual content via a local fixture server, verifies the sync produced content, then validates that scoping filters by repository viewer permission. The test properly checks that granting an object-level viewer role makes content visible.

4. Typo fixed.

LGTM — the access policies, locked roles, model permissions, conditions, post_migrate signal, settings, and tests all follow pulpcore patterns correctly. Comprehensive test coverage across CRUD, sync, cross-object permissions, role management, version delegation, content scoping, object-level scoping, and unauthenticated ping access.

[dkliban]

(superseded — see updated review above)