Access control: Replace all role checks in frontend with CanCanCan

[ManuelMoeri]

After all the other access control tickets have been completed (#946, #947, #948) this one may be tackled as well. Basically all the existing checks need to be replaced with CanCanCan checks. Alongside that you'll also need to add new checks for the new roles so that they may use their role as intended.

This story also includes displaying messages when a error is raised.

TODO

• [ ] Replace old checks
• [ ] Add clear error messages
• [ ] Tests
• [ ] Update CHANGELOG.md