Replaced loadedPermissions with role

[allouis]

ref ENG-728 ref https://linear.app/tryghost/issue/ENG-728

The loadedPermissions were only used to check roles or whether an api key was used. The later is already exposed on the context object, so we just need to pass the role. This allows us to internally change how permissions are loaded without having downstream effects, it also moves us closer to pulling roles out of the db and into hardcoded strings.