Use FlowAction permissions in AbstractRevision

... instead of the hard-coded permissions, which make it impossible to have
different permissions per action (e.g. to hide posts, users must have flow-hide
permission, but they don't need that permission to see hidden posts)

FlowActions already check permissions against the current moderation status, so
mostRestrictivePermission is useless now.

Also stop using AbstractRevision::isAllowed outside of AbstractRevision objects.

Meanwhile also changed permissions for hidden posts; logged-in users can now see
them (as requested in mingle 421)

Mingle: 421
Change-Id: Iaca064314cca91b66ab9064e5c7ecaff73fda508