Add support for specific queries

Adds support for modes of this format:

module.exports = {
  'submit review': async function (userId, operation, object, context) {
    const user = await context.models.User.find(userId)
    return user.name === 'User One' && object.title === 'Book by User One'
  }
}

A REST example would be e.g.:

module.exports = { 
  GET: (userId, operation, object, context) => {
    const mode = new XpubCollabraRESTMode(...arguments)
    return mode.result()
  },
  POST: (userId, operation, object, context) => {
    return false
  }, 
  PATCH: (userId, operation, object, context) => {
    return false
  },
  DELETE: (userId, operation, object, context) => {
    return false
  },
}

The new mode format is a way to address specific authorization questions that come with GraphQL (e.g. 'submit review') in a clear manner. Old modes are supported, no breaking changes.

Any operation/query that isn't supported defaults to returning false.