Allow authorize to pass arguments to policy methods.

`authorize` currently assumes that each policy has enough information to
make a decision. I have found that this is often not the case as described in
the policy below.

class ProjectPolicy
  # Determine if user is allowed to remove other_user from the project.
  #
  # @return [Boolean]
  def remove_user?(other_user)
    user != other_user && project.owned_by?(user)
  end
end

`authorize` has been patched to send any extra arguments to the policy which
makes the above possible.

class ProjectsController < ApplicationController
  include Pundit

  # This isn't RESTful but shows intent.
  def remove_user
    authorize project, :remove_user?, other_user

    project.remove_user other_user
    respond_with project
  end

  private

  def project
    @project ||= current_user.find_project params[:id]
  end

  def other_user
    @other_user ||= project.find_user params[:user_id]
  end
end
Update README with `authorize` example.