Allow can with query on single resource

[kaspernj]

Passing a query to a rule is already supported by accessible_by but not when checking on a single resource. This PR fixes that and adds specs for it.

Example usage:

can :read, ProjectPart, state: "won", offer_won: {account_id: current_accounts.select(:id)}

[kaspernj]

Did anyone have time to take a look at this? :-)

[oboxodo]

I just posted an issue related to this (but a bit more general maybe?): https://github.com/CanCanCommunity/cancancan/issues/812

And a PR with a proposed change: https://github.com/CanCanCommunity/cancancan/pull/813

Open for feedback.