Fix studio for users with derived roles and some other related changes [BB-7834]

[0x29a]

Description

There are three commits serving different purposes:

• 1b0fbd379932a2149d549f08d0086a5bd1741d34 — fixes the issue when users having a derived role (when staff is the base, for example) can't see their our courses in Studio, while staff itself can. See this PR for more details.
• 2ae88bc19129d7db2f8e4ae191a78dd26c058af8 — make it possible to perform a "strict role check". This is helpful when we need to "remove" some permissions that a base role has. Example of usage.
• a04ffaefbba3783f341883fec7ba921b5d171331 — small refactoring, upstreaming of fix: eSHE Instructor should be able to see forum members and enrollments [BB-7841] open-craft/edx-platform#585.

Testing instructions

This needs mainly proofreading and regression testing:

1. As a user with Course Staff role check that you see your own course in Studio and that no views from the Instructor Dashboard are throwing errors.
2. Run this in the LMS shell:

from common.djangoapps.student.roles import strict_role_checking, ACCESS_ROLES_INHERITANCE
with strict_role_checking():
    print(ACCESS_ROLES_INHERITANCE)
print(ACCESS_ROLES_INHERITANCE)

You should get this output:

{}
{'staff': {'limited_staff'}}

[openedx-webhooks]

Thanks for the pull request, @0x29a! Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket as you can:

• supporting documentation
• Open edX discussion forum threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

[Agrendalath]

@0x29a, one request - please add a comment to the context manager to explain why it's here and what it can do in the plugins.

👍

• I tested this: checked the access role inheritance behaves correctly (except for the issues fixed in fix: limited staff cohorts and gradebook access [BB-7962] #33491)
• I read through the code
• I checked for accessibility issues: n/a
• Includes documentation: n/a
• I made sure any change in configuration variables is reflected in the corresponding client's configuration-secure repository: n/a

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production.

[openedx-webhooks]

@0x29a 🎉 Your pull request was merged! Please take a moment to answer a two question survey so we can improve your experience in the future.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.