Derive the update_location_record permission from the manage_repository.

Only Admin and Repository managers can update location records.

Modify User#can? to not raise an error when the derived permission is not given to the user, instead return false.

Patch the tests to take into account the new derived permission off manage_repository.