[#82966592] Clean up figures controllers and policies

In order to modify figures, they must only be permitted to view the paper that the figure belongs to.
Do we still need this policy if we don't use the engine's controller any more?