Ownership by teams instead of organizations

[jace]

As a simple fix for our current status with (a) lack of roles (#118), (b) migration issues with propagating changes in Flask-Lastuser and all client apps (#185), and (c) profusion of organizations just to provide access control, what if we change the "ownership" paradigm from Organization to Team?

Hasjob's Board model, for example, can change the owner field to refer to a team. This will require changing the Owners widget from the current radio list to a grouped select widget, a new sort of widget that can perhaps be included in Baseframe.

Funnel's ProposalSpace model already refers to a team, but does the more error prone thing of replicating teams from Lastuser. This could be pruned down to storing just an id.

This still leaves us with one problem: admin access to the Profile model in client apps.

[jace]

#151 (De-link organizations and teams) is related.

[jace]

The User model's user_organizations_owned_ids method should be complemented with user_team_ids in both Lastuser and Flask-Lastuser.

[jace]

If we consider the latest thinking in #91 and #151, it makes sense to move ownership to the Principal model rather than the Team model. Organizations now start out being just like teams, and later acquire actual teams (and sub-organizations in #6) as the complexity grows.

The "admin access" problem can be resolved with roles (#118).

This ticket has had half-baked implementations in Hasjob and possibly elsewhere. These will now need to be migrated to Principal.