Extract context-query-filter code into `ggrc.rbac`

* Make consistent application of context filters easier
Use `session._permissions_loaded` to avoid duplicate query

* Previously, UserRole query was being executed many times per request
Add very basic information for monitoring performance