TAN-7562 Project policy and roles

[luucvanderzee]

• Adds folder_id to project shared_permitted_attributes conditionally in project policy, not controller action.
• Extends project approval (publishing a 'never published' project) to space_moderator or project's space, by using can_moderate_folder? in policy.
• Permits SM to delete 'never published' project in their space.
• Adds folder-move rules to ProjectPolicy#update?: folder/space moderators (evaluated against the persisted pre-change project) can only move a project into a folder they moderate; removing the folder requires the project to have never been published.
• Adds matching space-move rules: folder/space moderators (evaluated against the persisted pre-change project) can only assign a space they moderate, unless the space change is a side-effect of an allowed folder move; removing the space requires the project to have never been published.
• Adds a second authorize @project call after assign_attributes in ProjectsController#update so the policy can inspect pending folder/space changes via dirty tracking (folder_changed? / space_changed?).

Changelog

Technical

• [TAN-7562] Space Manager can now approve or delete a 'never published' project in their space + special-case policy rules when updating project's folder or space (feature in development & behind FF)

[notion-workspace]

Rewrite project policy and finish sorting out roles

[cl-dev-bot]

	Messages
📖	Changelog provided 🎉
📖	Notion issue: TAN-7562
📖	Run the e2e tests
📖	Check translation progress

Generated by 🚫 dangerJS against 9738db4