The current access control function `can_translate` is not always
sufficient. For instance, some projects require access to translation
to be controlled using a permission rather than using groups.
This change introduces a new setting `ROSETTA_ACCESS_CONTROL_FUNCTION`
that allows an alternative predicate to be specified. The default is to
use the current function so this change is backwards compatible.