don't allow :manage_courses_(delete/reset) for TA roles
don't allow :manage_courses_(delete/reset) for TA roles

We don't want to allow the ability for base TA or custom roles
built off the TA role type the ability to reset or delete courses.
Our permission policy for the Course model doesn't grant
:manage_courses_reset or :manage_courses_delete for the TA role
type as they are not considered "content admin" enrollments.

fixes FOO-2166
flag = none

test plan:
1. I don't believe a migration datafix is warranted
2. Conduct console cleanup on any existing TA role types that were
   granted :manage_courses_delete or :manage_courses_reset and
   disable those role overrides after this gets merged and deployed.

Change-Id: If208f89e44ae6bcd67bdcf3df58522c44dfbe24f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/268745
Tested-by: Service Cloud Jenkins <9144042a601061f88f1e1d7a1753ea3e2972119d@instructure.com>
Reviewed-by: Cody Cutrer <c4fe2b1d90ef8f2548c8aeabfa633434316f0305@instructure.com>
QA-Review: Cody Cutrer <c4fe2b1d90ef8f2548c8aeabfa633434316f0305@instructure.com>
Product-Review: Cody Cutrer <c4fe2b1d90ef8f2548c8aeabfa633434316f0305@instructure.com>

sfu/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,sfu/canvas-lms