check for ancestors to match permissions, too

I think this is what users expect - at least I did and wondered what
was wrong.

```
class A
end

class B < A
end

can :read, A

can? :read, B # => true, without this: false
```

Only works if `@subject` is a class always (is it?) - otherwise one can simply check `@subject.is_a?(Class) && subject.class <= @subject`.