Allow Curators to make Collection owners unable to add workflows/users

[odonoghn]

Allow Collection owner to be a point of contact rather than a sub-Curator. We want a ticket process to control access to collection workflows and users in a SOX-dedicated gallery and giving those permissions outside the ticket process would be a hole in our control environment. Currently we make a service account the owner, but that means we need a list of contact people on the side.