WIP Policy Refactor, Extender

[askvortsov1]

Foundation for fixing #1832
Part of #1891

Changes proposed in this pull request:

• Ask that policies return ->allow, ->deny, ->forceAllow, ->forceDeny instead of true/false to increase flexibility
• Improve evaluation of whether a user has the ability to do something on an instance to avoid order-dependence.
• Rename getPermission (->checkAbility), scopeModelVisibility (->scopeQueryListener) methods, as well as the methods scopeModelVisibility calls (->scopeQuery, ->scopeQueryPerAbility), for purposes of clarify.
• Restructure old scopeModelVisibility calls down to only 2 methods
• Refactor how policies are registered by moving them into the User service provider, making an Extender more viable
• Removed the GroupServiceProvider as it no longer does anything
• Deprecate everything that's no longer used
• Add Policy extender
• Added integration tests for policy extender (dependent on Add Authenticated Test Case utility #2052)

Reviewers should focus on:

• I don't like that the gate->before callback now requires us to app->make ALL the policies every time we want to check a permission. The same applies to the part where we listen to ScopeModelVisibility. Should I add a singleton that contains resolved instances of all policies?
• Are the new names what we want?
• Do we want to get rid of ScopeModelVisibility?

TODO
If this is accepted and merged, bundled extensions will need to be updated.

Confirmed

• Frontend changes: tested on a local Flarum installation.
• Backend changes: tests are green (run composer test).

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. We do this to keep the amount of open issues to a manageable minimum.
In any case, thanks for taking an interest in this software and contributing by opening the issue in the first place!

[askvortsov1]

Not stale.

[SychO9]

are these meant to be constants ? if so let's declare them as such:

public const ALLOW = 'ALLOW';
public const DENY = 'DENY';
public const FORCE_ALLOW = 'FORCE_ALLOW';
public const FORCE_DENY = 'FORCE_DENY';

[SychO9]

If this is deprecated, why don't we just call checkAbility from here, instead of having duplicated blocks of code.

[SychO9]

same here, why not just call scopeQueryListener

[SychO9]

Before this refactor, when policies were listeners, they were resolved only once.

How about we resolve them all in an array before making the gate and then we use that array of all resolved policies inside.