Use a policy to determine access to /manage/

[wilson29thid]

Instead of putting the logic in User#active_admin_editor?, create a ManagePolicy using Pundit's headless policies approach, just for consistency.