Restrict stage visibility based on membership

[3mcd]

Motivation

So users only see stages they have permission to view.

Requirements

Modify stage-related queries so that:

• Community contributors can only see stages they have been added to directly or via groups.
• Community editors and admins can always see all stages.

If a user does not have the ability to see any stages, the link to "Workflows" in the side nav should not appear.

Acceptance Criteria

• Uses functions implemented in #671 to determine if the user has the viewStage capability for each rendered stage.
• End-to-end tests that assert that stages on the workflows page are only visible when the above requirements are met.

[kalilsn]

If a user does not have the ability to see any stages, the link to "Workflows" in the side nav should not appear.

This might be a little challenging to do efficiently with the current setup and may require a new (pretty simple) query either way.

[3mcd]

@kalilsn I agree that the requirement to show/hide the Workflows link adds a bit of overhead (one query per page load) for little gain. Instead I think we could always show the link and just put an informative message on the Workflows page if no stages are accessible to the user. Thoughts @gabestein ?