Fixes for a couple issues

Primarily, ensure `ContextImplication` objects pointing from `Program` scope into `NULL` scope exist with:
* migration
* Program.model_posted hook

Also, ensure `ControlCategory` and `ControlAssertion` permissions exist for relevant roles (previously-sufficient `Category` is no longer sufficient.

Finally, add `Task`-read permissions for System-wide "Reader" role -- this was missed from the previous Task-related pull request.