Refactor permissions checks (authorization) into single service

[skylar-anderson]

The goal of this PR was to make it easier to detect the current user's status in the context of their organization. Previously, this logic was scattered across many routes and components. aptible-ability offered some relief, but didn't work great outside of a template context. aptible-ability also required passing down user context models (organization, roles, etc) down to low-level components that shouldn't care about these otherwise.

This PR centralizes the users entire context (and how they relate to all of their organizations) into a single authorization context service. This sits on top of all authenticated routes and eagerly loads all resources required to make decisions about what UI a user should or shouldn't see. Removing the async nature of loading all of these resources significantly reduces the complexity of many of our routes.

The service is injected to all routes, controllers, and components so signature bloat on any component that needs context in order to render should be greatly reduced. (I fixed many of them, but there are probably more)

In addition to the authorization service refactor, this PR also adds a new "trainee dashboard" which shows the current users training history along with links to download their organizations latest policy manual. See image at bottom of this PR.

Also included in this refactor

• Opened it up so any organization member can click on any role to see members. It was confusing that only some roles were clickable. I also added logic to hide components that allowed editing of the role. un-permissioned users can just see role members.
• Consolidated role index pages (compliance | platform) into a single route with a type url param
• Fixed role#show breadcrumb to role#index, it was previously broken
• Added detection of current user's ability and redirect accordingly (on index pages)
• Fixed A LOT of broken test stubs that were only working because we were over-stubbing--this made testing auth-related features much more difficult to reason about.
• The environment permission toggle on role#show was broken -- fixed
• Add "My Gridiron" link to user dropdown
• Nest "admin" organization screens in new parent route--makes it easier to enforce authorization
• Renamed "compliance" => "gridiron" throughout
• Separated "Apps and Databases" into new "enclave" route. started using "enclave" throughout
• Removed a lot of broken activating-item components in favor of a plain old #link-to. We should remove this component entirely IMO.

fixes #680 fixed #664

New "My Gridiron Status" page:

---

cc @gib

[skylar-anderson]

Some quick follow ups to this PR that I'd like to tackle soon:

• Refactor aptible-ability to use an authorizationContext to make decisions
• Finally make a damn application loading route ⏳

[skylar-anderson]

Forgot to mention -- with most resources now eagerly loaded (and duplicate requests squashed), Dashboard feels way fast again.

[gib]

Amazing! :bow: Thank you @sandersonet!!

[skylar-anderson]

Updated to add an application loading route + removed the activated-item component entirely.

[gib]

Nice!