[TO STAGE] Environment variables should be protected with :edit permission

Environment variables are new, but permission to view them should be limited to users with the edit role or higher, and scopes that are edit or higher.

@liggitt review