Where are the server web editor privileges granted?
Server or Site admins grant the web edit options as part of the permissions set against project/workbook
If we have site roles - Publisher and Interactor - Are those users allowed to edit a workbook on the server?
The site roles are essentially a collection of permissions. The publisher role is only relevant to projects and you can control who can see the project contents and who can save into it (eg someone with ability to create new workbook from a published data source via the web can then save the workbook into the project). The interactor role is relevant to workbooks. By default those this role has the web edit permissions, but you can override it to remove that option, or you can add further control as to what they can do with the edited workbook - save, save as, move the workbook etc. Any change to the default role anf the role becomes listed in the UI as 'custom'). The editor role has all the web edit permissions by default.
The permissions screen looks like this
For the Tableau report viewers in my company, they have a 'custom' role listed as I made them 'interactor' but then removed options to add/view the comments and I also added the right to edit(save as) the workbook.
This article may help Permissions Reference
Are there different levels that can be granted to edit workbooks?
You can allow someone to save and/or save as - ie you could let someone edit a workbook but only have the ability to save as.
Can the underlying data source (like custom SQL), under any circumstances, be edited by someone on the web? if so, How can this be controlled?
No, the web edit capabilities only allow editing of the contents of the views, not access to the definition of the associated data source.