BoxSharedObjectBuilder: fix small bug in body generation
that missed to derefernce JSONStructures with permissions key first.

Also wrote three test to ensure settings for canDownload, canPreview
and access are properly set.