Add AuthClientUser role

[lyzadanger]

I foresee some cases coming up in which we will want to assign a permission for certain actions on resources only to requests that have an auth_client AND a forwarded user.

This PR adds a role that gets assigned to such requests to differentiate them from requests with any sort of authenticated user (role.User, which gets assigned regardless of the authentication mechanism).

[codecov]

Codecov Report

Merging #5389 into master will increase coverage by 0.04%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master    #5389      +/-   ##
==========================================
+ Coverage   96.77%   96.81%   +0.04%     
==========================================
  Files         426      426              
  Lines       24102    24594     +492     
  Branches     1305     1375      +70     
==========================================
+ Hits        23324    23810     +486     
- Misses        664      667       +3     
- Partials      114      117       +3

Impacted Files	Coverage Δ
h/auth/role.py	100% <100%> (ø)	⬆️
h/auth/util.py	100% <100%> (ø)	⬆️
tests/h/auth/util_test.py	100% <100%> (ø)	⬆️
h/search/query.py	98.12% <0%> (-0.89%)	⬇️
h/views/api/annotations.py	100% <0%> (ø)	⬆️
h/views/badge.py	100% <0%> (ø)	⬆️
h/views/feeds.py	100% <0%> (ø)	⬆️
tests/h/search/core_test.py	100% <0%> (ø)	⬆️
h/activity/query.py	99.15% <0%> (+0.29%)	⬆️
tests/h/search/query_test.py	98.67% <0%> (+0.37%)	⬆️
... and 2 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b3b814f...da38fc4. Read the comment docs.

[robertknight]

Functionally it looks like this does what it intends to. What uses did you have in mind for this Lyza?

[robertknight]

LGTM. I looked to see if there was a way of defining entries in __acl__ lists that require a user to be a member of multiple groups but I couldn't see anything like this in the docs, so it appears that an additional group is needed.