Eliminating the notion of volunteers

For now, just let people participate by starting a new
topic in the comments.  So there is no notion of
apply or having a specific volunteer.  May add it
back in later as requirements dictate, but not
necessary for now.
Create utils; update comments to support tasks

Created a new directory called `utils` in services in
preparation for tasks.  Include project.js and task.js
that provide the `authorized` function for checking whether
a given userId is authorized to view a particular project
or task.

Updated CommentController by refactoring the comment query
and processing code into a helper function which can be called
by both findAllByProjectId and findAllByTaskId.
Add a policy for task authorization

Tasks need a way to check if a given userId is authorized
to access that task.  Prevents unauthorized access to
endpoints.
Policy updates to control access

Be more comprehensive about what can and cannot be done.

There's a lot more to be done to prevent malicious access,
but this covers a lot more cases.

Need to be able to:
- check that you own an event before updating or deleting
- check that you own a comment before updating or deleting
- ... I'm sure there's a lot more.
Implement tag functions for tasks

Add `findAllByTaskId` in the TagController. Factor out
the tag lookup code so that it can be used by either
project or task tag lookups.  Update destroy to check
permissions for either project or task depending on which
is specified.
More policy work for tasks

Add `taskId` to check if taskId is specified in the body,
then make sure that you have ownership.

Additional changes to create/update/destroy
More policies to prevent malicious data access