This cuts the number of queries in 6.002 courseware loads from ~650 to
~5-40. Still to do: cache CustomTag templates so that we only load them
once per request.

- get_module() contract says it can return None (e.g. if access control check failed)

The real fix would be to have yield_dynamic_descriptor_descendents return
things in the proper order, but I'm not entirely sure what's going on
there, and this is a bug on prod now.

- go through all students, all of their problems, save count for each answer
- return csv
- url exists, but no links to it yet
- Will need to integrate with Ike's new dashboard code

functionality - grade dump and download as csv, manage staff list,
force reload of course from xml

* reorder index fields

* Update all uses.

* apply policy per-course, even if multiple courses share course and org fields
* keep descriptors separate in xml store, so that if two such courses
  change the same module in different ways, it works.  Such edits will need to
  merged on CMS import...
* add get_instance(course_id, location) method to replace get_item(location).
  Update all the call sites
* tests, including a 2nd toy course with same course and org.

* error modules now hidden via access control
* get_module() returns None if user doesn't have access

Added stores_state attribute for xmoduledescriptors as a way to declare if the module stores state in the database.