updated authorization for all controllers ...

-changed from passing through records as feature not supported
-changed 403 error to better reflect what's happening
-added scope to many of the indexes
-added organisation-scope to requests from old org-admin roles
-renamed guidance_groups_policy to guidance_group_policy.rb

added pundit auth to dmptemplates controller

added pundit auth to guidance groups

added pundit auth to guidances

added pundit auth to organisations controller

added pundit authorization to users

proof of concept for pundit ...

-got the pundit policy file working
-verified that it blocked/allowed users with correct permissions
-fixed a bug in user model where the magic strings had been poorly defined
-