Extract context-query-filter code into `ggrc.rbac`

* Make consistent application of context filters easier
Use `session._permissions_loaded` to avoid duplicate query

* Previously, UserRole query was being executed many times per request
Fix test to insert join object in correct context
Merge pull request #400 from reciprocity/feature/rbac_fixes

RBAC system roles fixups