Authorization exploration

## Authorization

This is an **experimental** branch to test out if we should move over from CanCan to Pundit (https://github.com/elabs/pundit). It also kind of uses Devise (not really, but we need a current_user method like before).

Pundit uses Policies to control what a user can do and so far this is what I've tested:

### ApplicationPolicy
By default Godmin has a `Godmin::ApplicationPolicy`. For now it just has one method called `has_admin_access` which returns true. This should be the default settings from which all other Policies inherits. Inheriting is actually optional but perhaps it is a good idea :)

### Specific policies for admin
When creating a new resource, say `Article` you need to create a policy as well. Minimum implementation is:

```ruby
# admin/app/policies/admin/article_policy.rb
module Admin
  class ArticlePolicy < Godmin::ApplicationPolicy
  end
end
```

If you use Pundit in the frontend as well and you want to use the same Policy, that is possible too. If we don't find any Policy in `admin/app/policies/admin/article_policy.rb` we fall back to `app/policies/article_policy.rb`. Or they can inherit from each other and so on....

### Scopes
Let's say that admins who belongs to a certain department only can see articles from that department. Pundit provides simple scopes for that, if we want to use that :)

Example:
```ruby
# admin/app/policies/admin/article_policy.rb
module Admin
  class ArticlePolicy < Godmin::ApplicationPolicy
    class Scope
      def resolve
        if !user.superadmin?
          scope.where(department_id: user.department_id)
        else
          scope.all
        end
      end
    end
  end
end
```

Then in the controller we can make use of the `policy_scope(collection)` method. (It is used right now in `Godmin::ResourceController#collection`.


So far it seems pretty cool and I want to use `Pundit` :thumbsup: