#26 Update permissions for self-assessments and additional feedback

@wlbehr and @ajablonski pairing
- Users can only add/update self assessments for their own reviews
- Admins cannot edit or start self assessments
- Only the user who owns a review can add additional feedback for that review
Along with:
- Refactor ability
- Move more validation to ability.rb from controllers
Unused block argument - `feedback`. If it's necessary, use `_` or `_feedback` as an argument name to indicate that it won't be used.