Fix permission checks for map/unmap operations

* adds `is_allowed_for_all` helper to check a single permission against
  multiple instances
* adds `is_allowed_to_map` helper to check for permissions to add join
  objects
  - this is similar to `can_link_to_page_object ...` and
    `is_allowed 'join_create' ...`, but unified and cleaner, since we
    only need this one for `create` action (in other cases, we have the
    instances themselves to get the context)
* applies helpers to all `tree.mustache` "+ Object" and "unmap" cases