rewritten permission checks to use sql

:exclamation: merge after https://github.com/opf/openproject/pull/1750 :exclamation: