Other policy cleanup

* Move more policy spec assertions into shared examples
* `TaskAccessCriteria` has two methods, `authorized_to_modify_task?` and `authorized_to_create_task?` that do all the actual authorization work in any policy that includes it.  
* Avoid using `create(:paper, :with_tasks)` because it's slow.
* Avoid making a user a `:site_admin` for no reason.