Draft: Add scope permission checks when creating workspaces

This is a first attempt at introducing model-level permission checks

• try hooking into the save() method instead of create()
• introduce a context.management_command boolean flag, to be used by model tests instead of permission overrides
• move mock_patch from permissions.py to debusine/test/django.py