Add notice, fix some potential security edge-cases

[joshreisner]

for #1321

• define constants (so they can't be altered) for permission levels
• create shared functions to require correct permissions or die
• require permission whenever some write action could be taken
• use closures in a few cases where feasible because they are not available to other plugins / themes
• remove database upgrade functions since they are no longer needed and could appear to a security researcher like a vulnerability

[anchovie91471]

Simple enough

[dvcb]

Looks like good changes

[kiyote33]

Interesting that security testing with this fix produced exactly the same result as before: "Sorry, you are not allowed to access this page." for all our menu items, except Regions and Districts which had the "You need a higher level of permission. Sorry, you are not allowed to manage terms in this taxonomy." I commented out the "tsml_require_meetings_permission();" code on the import file with no effect. Both the subscriber and admin roles continued to work as expected. It's looking to me like this code is not having an overriding effect. We have the same state on all my tests as before. Hopefully it will suffice to have the critical security issue withdrawn by the PatchStack folks. I think we could drop the TODO comment in admin_import and consider this done. Thanks for your work on this Josh...