project read policy

[yujonglee]

something live below:

bypass action_type(:read) do
  authorize_if expr(public == true)
end

policy action_type(:read) do
  authorize_if relates_to_actor_via(:account)
end

currently we are filtering based on public in call-side, which is error-prone.

Note that after this policy change, there's lot to change.

e.g:

• project filtering search interface
• project finding in create_document