Refs #5720: Proper resource scoping including authorization.

I am opening this initial PR (which has a corresponding Foreman update) in order to get some feedback from Foreman and Katello developers on the approach and the implications. 

The backstory is that in Katello we need to properly scope all resource lookups across our controllers. Foreman uses some common methods in their base_controller to centralize that scoping and data lookup. For Katello to take advantage of this (and other plugins as well in my opinion) there are a few changes on the Foreman side (https://github.com/theforeman/foreman/pull/1596).

I have created this initial PR as an example of the Katello implications and changes if we attempt to better align with Foreman methods and take advantage of them for our scoping. Further, I have chosen a nested resource (i.e. repositories get their permissions from their product) to show a full example of what is required. If this was a first class controller (one that has a direct permission) all that would need declaring is the `action_permissions`. For a nested resource, you'll note that `resource_scope` is overriden in order to account for the nested permission and that for all related objects (product, organization, gpg_key) the use of find_nested_object is used.
where is this getting created ?