Fix eager loading for various endpoints

* Fix use of `undefer_group` and `subqueryload`
* Fix `ControlCategorized.eager_query`
* Ensure `get_current_user_json` actually uses eager loading
Add permission checks around import/export endpoints
Fix client-side permissions to respect `__GGRC_ALL__`

* Previously, permissions for `view_object_page` were ignored in some
  cases because permission lookup only checked the resource type itself,
  and did not check the `__GGRC_ALL__` resource type
Don't show "Import Controls" when user is not allowed

* Same for "Import Objectives"
* Should only have visible impact on Program page
Fix typo to show "Edit Audit" only when user is allowed
Only show `View Program` when user is allowed to do so
Only show "Create" button when user is allowed to do so

* Previously, this button would always appear, and user would see a
  large "Forbidden" message
Use correct Program when editing Audit

* Otherwise, editing the Audit from some pages may change the linked
  Program or break editing ability
Fix `get_mappings` to return the correct Direct mappings
Prevent script error due when unmapping unmapped object

* Basically, when deleting some objects, the "refresh" of objects linked
  to the deleted object can complete before the object is removed from
  mapping lists.  In these cases, the object will be removed from the
  mapping lists by other means (propagation of `stub_destroyed` events
  to the affected models).
Ensure that `Direct` mappings are loaded correctly

* The `binding.instance` value may not be loaded, so delay
  initialization until that is complete.
Eager load `Context.user_roles` on `Context` endpoint
Add permissions for `Context` and `UserRole` reading

* Before Sprint 28, `Context` was not a first-class resource, but now it
  is, so roles should have access to `Context` resources.
Add and use `Context` and `Context.user_roles` in mappings
Eager load basic data for `ObjectiveSection.section`

* This is needed because `Section` is polymorphic
Don't refresh mapping on attribute change unless necessary

* Previously, the process of refreshing the instance would trigger
  `refresh_stubs` on unused mapping lists
Fix role lookup for Auditor
Ensure authorizations are loaded before querying them

* Caused `Map Objective` link to appear for Auditors
Merge pull request #1331 from reciprocity/feature/fix-import-export-permissions

Fix import export permissions
Merge pull request #1332 from reciprocity/feature/fix-some-p1s

Fix some p1s