Add Product.is_review_permitted check

Default implementation respects OSCAR_ALLOW_ANON_REVIEWS and only allows
one review per user. Should be easy to customise (e.g. enforcing the
user purchased the product).
Switch to is_review_permitted in templates

Also removes the now obsolete has_review_by template filter.