Refactored API VariantsController scope.

The Spree::API::VariantsController commits a few crimes:

1. Using .active in an attempt to get non-deleted variants, when active
has nothing to do with active, and instead determines if the Variant has
a price in the current currency.

2. Uses || for a permission check instead of &&

3. Explicitly tests a users role rather than testing permissions

4. Uses unless/else

5. Duplicates code

This refactored code should be easier to read, and more correct.

Fixes #4519