When configuring API tokens, the client code had a pre-built set of API

token policies that could be chosen alongside a custom policy document.

This presented "Read-only" and "Full access".
Some in-progress work will be adding at least one more token policy

template to the list, and it won't be in core Review Board code.
To prepare for this, we now have new central definitions maintained

within the server-side code, which extensions can also provide. This is

all defined in a reviewboard.webapi.token_policies module, which has a

registry, base class, and the built-in Read-only and Full Access

policies.
All policies from the registry are passed to the My Account page for

managing API tokens. The JavaScript code then takes this and introspects

it instead of hard-coding a bunch of token types.
Some error handling has also been added when setting policies in order

to avoid silently erroring out if a token policy references some invalid

resource, which I found during testing.

Unit tests pass.
Tested adding a new token policy in an extension and seeing it show up

(and match on load) in the tokens view.
Tested setting all the policies.