Classification permissions

Adds permission controls for classifications. 
Re https://github.com/rails/rails/issues/12753, is there any way the group_scope bind values (user_id for the actor) can be different to the project scope bind value (again the same user)? If not then we could just use one of the bind values to make it work.