Properly check booking privileges on the server

[ThiefMaster]

This depends on #3591.

Currently we simply check for admin privs and if a room uses prebookings to determine what kind of booking someone can create.

Instead of that we should actually return this information from the server to have a single source of truth, especially since we need to perform the check again when actually creating the booking.

Client-side code should already be using room.canUserBook and room.canUserPrebook for this, so all that's needed on the client is fetching the data with an API call and updating the getAllRooms selector to get the information from the correct place instead of the current "simple" check mentioned above.