CRM457-2019: Move all authorisation logic to Pundit

[patrick-laa]

Description of change

• Move all logic about what a user can/can't to to Policy objects
• add authorize calls to controller layer so that users can no longer access screens that are associated with permissions they don't have
• If a controller action calls neither authorize nor skip_authorization, Pundit will raise an error. This ensures we don't accidentally forget to add authorisation to new actions etc.
• If a user is unauthorised, redirect to root path with an error message

Link to relevant ticket

Notes for reviewer

The NSM controller specs all broke because Pundit doesn't play nicely with doubled Claim objects. As those controller specs were pretty shonky (they were line-by-line describing the controller code and stubbing every instantiated view model instead of describing the behaviour of the controller), I've rewritten a lot of them.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud