Fix/permissions for work package index

https://www.openproject.org/work_packages/10435

Need to write some tests.
@ulferts this is slightly misleading as the meta data from the work packages index isn't a model like AuthorisationService.cannot is expecting, but i think this approximates how the data will be returned form the hateos api.