AppProxy with permissions checks and app context

Ref #2059 (ACL for Apps)

- Refactor appProxy into class that is instantiated per App
- Check for permissions before doing proxied method calls
- Unit tests for most of the situations I could think of

I know that the API is going to be running their own `canThis({ app: '...' })` checks, but I was already doing a kind of wrapped permission check with filters and helpers so I threw in another quick gated check for method access in this PR.  If you think it's gonna cause harm somewhere down the line, I'll take it out and just do a straight pass thru while running with the `{ app: '...' }` context.

I also made an assumption about requiring filter permissions by name of filter because I didn't hear back after my last comment about someone potentially registering a `prePostsRender` filter for an app that's permissions didn't allow read access to posts.  I figure being explicit will be better for us in the long run, and at least this way a user knows when an app is requesting access to a filter that potentially could give them access to post content, user content, etc.