#26 Update permissions for self-assessments and additional feedback

@wlbehr and @ajablonski pairing
- Users can only add/update self assessments for their own reviews
- Admins cannot edit or start self assessments
- Only the user who owns a review can add additional feedback for that review
Along with:
- Refactor ability
- Move more validation to ability.rb from controllers