Add app permission checking to canThis

Progress on #2059

- Create apps table and App model (Increments schema to 003)
- Pass permissions loading to buildObjectTypeHandlers to eliminate shared state
- Load both app and user permissions to check in canThisResult
- Check app permissions if present after user checks.
- Move effectiveUserPermissions to permissions/effective.js so logic is one place.
- Change permissable interface to take context; has user and app and could contain more in future.
- Add unit tests for app canThis checks and effective permissions

Not really sure if I'm doing the schema stuff correctly, so feel free to review that.

In order to start using this #2179 will need merged, and then we'll need to push the loaded permissions into the database during app loading.  I thought this was big enough by itself without adding that stuff in.