Allow anonymising document uploads

Documents can now be anonymised by the uploader. These documents will appear to have the author "anonymous" to regular users, although the original uploader and admins can still see the real author.

For this change, all frontend URLs for documents have been changed from /user/:username/document/:slug to /document/:slug. All corresponding backend URLs have been altered similarly as well. This is because otherwise the URL would reveal the anonymous uploader. This was possible thanks to the document slug being guaranteed to be unique upon generation, and documents can be retrieved using the slug alone.

Further, the /api/document/file/:filename endpoint to download an individual file has been moved to be /api/document/:slug/file/:filename as files are direct descendants of documents and it made semantic sense to move it.

Finally, /api/document/listdocumenttypes was moved to the top of the Django url pattern list, as otherwise there could be a user-uploaded document with the slug listdocumenttypes that would override the desired endpoint.