phase7: add minimal read-only drf api with player search endpoints

apps/api/permissions.py

@@ -0,0 +1,6 @@
+from rest_framework.permissions import BasePermission
+
+
+class ReadOnlyOrDeny(BasePermission):
+    def has_permission(self, request, view):
+        return request.method in ("GET", "HEAD", "OPTIONS")