Add permission checks to Rest API

[balloob]

Description:

This adds permission checks to the Rest API.

Since a lot of these APIs directly touch the core pieces of HA, they are limited to admin only (updating states, streaming all events, rendering arbitrary templates).

Checklist:

• The code change is tested and works locally.
• Local tests pass with tox. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.

If the code does not interact with devices:

• Tests have been added to verify that the new code works.

[pvizeli]

Can we put Hass.io user first into admin group?

[pvizeli]

After this PR we can also start to remove the legacy API password :P

[balloob]

This should not be a breaking change. I'll fix the Hass.io user and put it in the admin group. After that it should not be one?

[balloob]

Updated so that Hass.io component migrates existing user to admin and new users will also be created as admin.

[pvizeli]

All script they use new long live token doesn't work anymore if they create it with none admin users -> breaking changes? Also scripts with old API token system. That affected a lot of installations.

[balloob]

All existing users are part of the admin group. Only system users were not automatically migrated but that's only needed for Hass.io, which I have added.

[balloob]

About removing the legacy API password -> we need to update all HTTP tests to be using access tokens first…