Don't use PrincipalsUtil from AuthzAPI

The `canInteract` method uses the PrincipalsUtil to fetch principals from a list of ids. Instead, the full resource items should be passed into AuthzAPI from the consumer, and fetch with preferably the DAO instead of the Util, since the Util technically will "scrub" data from it which could be a bug waiting to happen. I think the AuthzAPI can so far assume a minimal model of:

```json
{
  "tenant": {
    "alias": "<alias>"
  },
  "id": "id",
  "visibility": "<visibility>"
}
```

It can probably even generalize a "joinable" property as well.