rewrites permission checks in sql
removes now unneccessary eager loading

As the permission check is now handled differently, eager loading
memberships is no longer necessary.
employs Project.allowed for sql string condition
removes unnecessary options parameter
introduces needs_authorization
adds missing permission to spec for anonymous
fixes specs broken by changes to allowed
adds missing attachments i18n
provides scope to order by name

The order is determined by the currently active setting
adds a "builtin" scope for user
introduces scope to only select name attributes
wip - possible_watcher_users
uses consistent methods for work_package watcher
eager load colors for types
prevents sql name clashes (ambiguous column)
uses allowed scope for project member filtering
work package helper refactoring
uses order_by_name
removes code duplication
define order for activities in any case