Fixes #5503/BZ1102315 - restrict UI interactions to actual permissions.

http://projects.theforeman.org/issues/5503
https://bugzilla.redhat.com/show_bug.cgi?id=1102315
> Can you not just call User.current.permissions as well? There seems to be a relationship between the two in the AR file.

I really wish I could, but I cannot:

```
ActiveRecord::StatementInvalid in Bastion::BastionController#index

PG::AmbiguousColumn: ERROR:  column reference "role_id" is ambiguous
LINE 1: ... WHERE "cached_user_roles"."user_id" = 1 ORDER BY role_id, f...
                                                             ^
: SELECT "permissions".* FROM "permissions" INNER JOIN "filterings" ON "permissions"."id" = "filterings"."permission_id" INNER JOIN "filters" ON "filterings"."filter_id" = "filters"."id" INNER JOIN "roles" ON "filters"."role_id" = "roles"."id" INNER JOIN "cached_user_roles" ON "roles"."id" = "cached_user_roles"."role_id" WHERE "cached_user_roles"."user_id" = 1 ORDER BY role_id, filters.id
```