Switch from canary to bodyguard

[joshsmith]

Another library came to my attention at ElixirConf that looks a lot more explicit in its implementation than canary and maps closer to Pundit than cancancan. It's named bodyguard.

We should do a PR to switch from one to the other. Should be relatively trivial considering the similarity of can?/3.

[joshsmith]

Per #332 the current canary library is causing two records to load. bodyguard will not.

[begedin]

Outline of what needs to be done here

• switch dependency from canary to bodyguard
• move most code from models/ability.ex into individual policy classes, with minor tweaks
• get rid of load_and_authorize_resource and instead manually call authorize from within handle_create/_update/_delete

Should probably be done with adding ja_resource into controllers that don't have it yet

[joshsmith]

I'll tackle #349 first actually today, if I can get to it in time.

[begedin]

0.3.0 of bodyguard supports permitted attributes. It's not as flexible as changesets, but we should look into using those when we find the time.

Still not sure how it works in conjunction with ja_resource