add support for roles and workflow

[pdpinch]

Allow staff to add grades, but they shouldn't be presented to the student (nor recorded in student state) until an instructor has approved them.

I think this can be done by adding an adding an "approved" field that can only be changed by an instructor. Grades are not returned to the student unless the approved field is set to true.

An enhancement would to have this be an optional feature, although I don't know where the option could be set -- perhaps when the problem is authored?