Split repository moderators from managers

[ajrbyers]

Stacked on #5612; review that first. This PR's own change is the last commit.

Separates repository moderators from managers. Moderators handle submissions and updates; managers also configure the repository.

What changed

• Repository.moderators (migration repository 0063) and Repository.moderating_accounts() (managers and moderators).
• Account.is_repository_moderator() and a @is_repository_moderator decorator. Moderation views (preprint list and pages, version queue, comments, reviewers, rejected and orphaned preprints, author editing) accept moderators; configuration views (subjects, fields, licences, settings, the new moderators page) stay manager-only.
• A Moderators page for managers to add and remove moderators.
• Moderators receive moderation notifications and can be chosen as submission notification recipients.
• The back office side menu splits into Moderation and Configuration, and moderators only see Moderation.
• repository/tests/test_moderators.py covers access by role, the menu and notifications.

For reviewers

• The API's IsRepositoryManager permission now admits moderators, so they can use the manager preprint API. That includes the licences endpoint, which allows POST and DELETE. Should licences stay manager-only?
• Link repository managers to preprint reports #5620 (reporting link) also touches this menu; whichever merges second needs a small conflict fix.