Fix phone permissions

- moved phone permission methods from `WhatAUserCanSee` concern to `PersonPolicy` 
- updated search_results to check for type and only check for permissions on person search results
- updated contact_info partial (used by `people#show`) to check PersonPolicy before showing the `employee_phone` field