Replace CanCan with Pundit for authorization

- Remove CanCan and associated Ability model
- Install Pundit and add default application policy
- Add WebpageRequestPolicy
- Add Pundit spec examples and custom RSpec matcher