Refactor policy framework

[NateWr]

This came out of a discussion about some authorization checks performed in the API handlers.

Alec:

The way the authorization framework tackled this was to tie together the fetching of an object (typically from the DB) with its validation. The risk of introducing security flaws typically happens when an object is fetched but never validated.

I think at some point we're going to need to move our current policy framework over into something standard -- like https://laravel.com/docs/5.7/authorization -- and that may help solve the problem here as well. But that'll certainly overload this task. Mind filing it for later?

Full conversation: #3931 (comment)