R1:7f0d0e4e6cc0

Make more Diffusion controllers/views capability-sensitive

Summary:
Ref T603. I got most of this earlier, but finish it up.

- Make a couple of controllers public; pretty much everything in Diffusion has implicit policy checks as a result of building a `DiffusionRequest`.
- Add an "Edit" capability to commits.
- Swap out the comment thing for commits.
- Disable actions if the user can't take them.

Test Plan: Viewed a bunch of interfaces while logged out, got appropriate results or roadblocks.