Add #verify_policy_scoped for controller usage.

See the readme changes for an example.  In short, this behaves
like verify_authorized but is useful for actions that find a
collection (like index) and don't authorize instances.