Add policy to PaperConversionsController via PapersPolicy

Allow anyone with access to view the paper to be able to export it
I agree with adding `primary_resource: paper` to the policy.   That will allow the policy to respond to either `resource` or `paper` when doing the `authorize_action!` call.  I am leaving it up to personal preference on which key you want to use.