Limit desk metadata endpoints to desk users

The doctype, versions and installed-apps helpers now require a System User, and the roles helpers require read access on Role.