Add Scope.can_create_workspace permission and check it in Workspace.save

This is a redesigned version of !1224 (closed)

This MR is probably best reviewed one commit at a time, since the last is a broad set of test suite permission fixes