Fix admin order tabs authorization

There is a syntax issue here that makes this code not behave as expected due to operator precedence:

```
if can? :update, @order && checkout_steps.include?("address")
```

This is the equivalent of

```
if can? :update, (@order && checkout_steps.include?("address"))
```

which is obviously not what we want.  Fixed version is:

```
if can?(:update, @order) && checkout_steps.include?("address")
```

Fixing the two instances of this problem surfaced another issue, where @payment_required doesn't exist; changed to @order.payment_required, and all behaves as expected now.

This is present in 2-0-stable and 2-1-stable; looks like 2.2 and later were refactored here, so I didn't dig any deeper into those to see if they were also affected.