LP#1863386: link ADMIN_CAROUSEL permission to appropriate OU context

LP#1863386: link ADMIN_CAROUSEL permission to appropriate OU context

This patch restricts prcrud retrieval and modification of templates
to users who have ADMIN_CAROUSEL in the relevant carousel owner OU
rather than requiring global_required.

To test
-------
[1] Apply the patch.
[2] Ensure that a user with ADMIN_CAROUSEL privileges at a depth
    lower than "Consortium" can only view and edit carousel
    definitions at OUs applicable to their working libraries.

Signed-off-by: Galen Charlton <gmc@equinoxinitiative.org>