Workflow controller

Just for sanity checking, could I get another set of eyes on this?  I tried to conform to styles/patterns already established, but it's worth verifying.
So we might want to check `authorize workflow.project, :read?` here, I'm not sure if we want workflows of private projects to be visible. Thoughts?