Make more Diffusion controllers/views capability-sensitive

Summary:
Ref T603. I got most of this earlier, but finish it up.

• Make a couple of controllers public; pretty much everything in Diffusion has implicit policy checks as a result of building a DiffusionRequest.
• Add an "Edit" capability to commits.
• Swap out the comment thing for commits.
• Disable actions if the user can't take them.

Test Plan: Viewed a bunch of interfaces while logged out, got appropriate results or roadblocks.

Reviewers: btrahan

Reviewed By: btrahan

CC: aran

Maniphest Tasks: T603

Differential Revision: https://secure.phabricator.com/D7152