Add authorization logic for Spree::Admin::Orders::CustomerDetailsController

While most of the admin controllers have authorization that can be controlled by defining abilities on various resources, this strategy cannot be used on the Spree::Admin::Orders::CustomerDetailsController as this is not a Spree::Admin::ResourceController and doesn't correspond to an actual model.

Instead we should link the authorization behavior for this controller to that of the associated Order, with the additional caveat that the 'show' action on this controller maps to an 'edit' action on the associated Order.

This PR includes the additional controller logic, as well a couple of feature specs.