Set DRF permission_classes and filter_backends globally

[brianhelba]

Move the de facto GuardianPermission and GuardianFilter defaults up to actual DRF defaults. This eliminates boilerplate and ensures that new ViewSets will automatically inherit the correct access control.

Note, DatasetViewSet and UserViewSet have exceptional overrides, to preserve their existing behavior.

[cloudflare-workers-and-pages]

Deploying geodatalytics with    Cloudflare Pages

Latest commit:	c9b105c
Status:	✅  Deploy successful!
Preview URL:	https://853b70bf.geodatalytics.pages.dev
Branch Preview URL:	https://drf-override.geodatalytics.pages.dev

View logs

[brianhelba]

@annehaley Ready for review.

[annehaley]

Strangely it looks like the test failures won't render properly for me on GH. I was able to run the tests locally (there was a lot of printout, so maybe it was too long for GH to handle). It appears to be an import error:

ImportError: Could not import 'uvdat.core.rest.access_control.GuardianPermission' for API setting 'DEFAULT_PERMISSION_CLASSES'. ImportError: cannot import name 'APIView' from partially initialized module 'rest_framework.views' (most likely due to a circular import) (/opt/django-project/.tox/test/lib/python3.12/site-packages/rest_framework/views.py).

[brianhelba]

I added one more commit to move access_control out of rest/. In addition to fixing the circular import error, I think this is a conceptual improvement, since rest/ holds the particular DRF views, whereas access_control is for permission utilities that are used to configure the views.