Use Pundit to improve authorization management.

Now that we’ve added more entities and more authorization checks, it
makes sense to use Pundit to clean things up.