Update Reaction.hasPermission's owner pass and replace instances of Roles.userIsInRole

[impactmass]

Reaction.hasPermission currently gives global access for users with "owner" role (i.e it always returns true for owners). This means that a check like Reaction.hasPermission("anonymous") will return true when we want it to return false.

This happens because Reaction.hasPermission joins "owner" to the roles passed to it. We need to remove that join, so that when we check for particular role(s), we are sure that the response is really based on if user has that role.

Then we need to ensure that all current usage of Reaction.hasPermission still works with this change.

After that, we proceed to replace instances of Roles.userIsInRole with Reaction.hasPermission.

[aaronjudd]

Related to, extends #2800

[impactmass]

Comment arising from PR:

I think there's a bit more planning to be done about how this will get merged in, because this might cause some side effects in places where hasPermission is in use.

• how we can test that there is no breaking change in other parts of core using this method
• how we plan to release this out. considering other folks might have built on hasPermission, and this might be a breaking change for them.

[brent-hoover]

@impactmass Since @foladipo is no longer here can you take this over?

[impactmass]

I can't at this moment, but maybe sometime in coming sprints

[spencern]

@impactmass @ticean should we continue to work on this issue in the near future?

[impactmass]

We can close this. We were working on it in relation to #4525.