Refactor permissions to use Pundit for all controlled actions

[martinemde]

As a developer, when I want to do something like "only an organization owner can change the owner of a gem that is also owned by an organization", it's currently quite complex.

In owners_controller, right now we authorize ownership changes like this:

  before_action :render_forbidden, unless: :owner?, except: %i[confirm resend_confirmation]

  def owner?
    @rubygem.owned_by?(current_user)
  end 

The problem is that this doesn't have any context about what action is happening. Is this adding ownership or removing or just viewing ownerships?

Using pundit (which is already added and used for Avo) we would need to change this so it authorizes creating, destroying or indexing ownerships.

List of controllers needing policies:

• Owners
• Rubygems
• Versions
• TrustedPublishers
• ApiKeys
• WebHooks

... Add more as needed

Note: We should continue to reserve admin related actions to avo_action?. An admin should not be allowed to, e.g. yank or add an owner outside of Avo.