Convert policy authZ from being based on a user to a user on a visit

[ZohebShaikh]

These are the current policies

Admin

1. Can create any task with a valid istrument_session
2. Can see all tasks
3. Can delete any tasks
4. Can start any task
5. Can abort any task

Users:

1. Can create any task with a instrument_session they are on
2. Can see tasks created by them
3. Can delete tasks created by them
4. Can start task created by them
5. Can abort task created by them

the policy change that @DominicOram and @EmsArnold suggested is
the policy for admin remains the same but for the users it will change as follows.

Users:

1. Can create any task with a instrument_session they are on
2. Can see tasks with a instrument_session they are on
3. Can delete tasks with a instrument_session they are on
4. Can start task with a instrument_session they are on
5. Can abort task with a instrument_session they are on

Acceptance Criteria

• OPA policies are tweaked according to the request

[DominicOram]

Just to add reasoning for posterity:

For most in-person visits experiments are performed by a team of a few users on site. The team are likely to run in some kind of shift pattern e.g. one person will look after the experiment whilst another goes to sleep/dinner. For long running experiments you can get into the situation where someone runs something, goes off to dinner and the person left realises that actually the running experiment is incorrect and wants to stop it.