Add cancan gem for authorisation
Fix test context to be in line with tests
Add user roles

The assumption is that the roles are hierarchical (ie an admin can do anything
that an editor can)
Restrict needs updates to editors
Only show "Edit" tab if user can edit needs

This change also separates the "view need" and "update need"
integration tests a bit cleaner, as well as removing duplication
(like checking whether the "Edit" tab is present in several places)
When user not authorised, redirect to /needs
Add authorisation to edit form
hide workflow edit button unless user authorised
Restrict need creation to editors
Hide the workflow buttons from viewers
Restrict need closing to editors
Hide need closing links from users who can't do it
Restrict need reopening to editors
Explictly authorise viewer actions

- listing needs
- showing individual needs
- listing revisions
Restrict descoping to admins
Hide the 'descope' panel from non-admins
Hide the Actions tab from viewers
Rename actions => perform_actions_on user ability
Enforce authorisation on NeedsController
revisions => see_revisions_of user ability