Introduce hasPermission mixin for checking rbac in frontend

[knolleary]

Prereq of #657

This PR changes how the frontend verifies if a user is allowed to access something.

It refactors the permissions table we use to secure the API so that it can also be used in the frontend via a new mixin called hasPermission.

hasPermission(scope) will return true/false depending on whether the current user has the necessarily team role for the given scope.

This is a much more declarative approach than testing specific role levels in each view. It also means we have a single source of truth for the rbac table.

---

You may note the mixin is called hasPermission, whilst its backend equivalent is called needsPermission. This reflects the differences in behaviour between the two.

• hasPermission returns a boolean
• needsPermission is a route preHandler that will reject an http request if the permission check fails