Consider differing levels of access

[cvalaas]

Now that we're starting to give more people (MoFo, Legal (GDPR reasons), etc) access to the API, we should probably consider adding a read-only access level at minimum.

┆Issue is synchronized with this Jira Task

[jwhitlock]

I agree, read, read-write, and eventually read-write-delete seem useful.

If we're giving keys to people rather than apps, we may also want to consider an SSO path, using LDAP or whatever backs SSO to segment permissions.