AO3-7050 Restrict ability to send invitation to email address

[Bilka2]

Issue

https://otwarchive.atlassian.net/browse/AO3-7050

Purpose

Restrict access to AdminInvitationsController create and index to the correct admin roles. I also did some cleanup of the controller.

References

PR limit does not apply to volunteers with write access to the repository.

Credit

Bilka

[sarken]

Just one thought, otherwise looks good!

[sarken]

Hmm. I'm not sure about this. It works with the current state of things, but it feels a little too easy to accidentally prevent a role who needs this menu from accessing it. For example, if we take support out of CREATE_ROLES and FIND_ROLES in the Invitations policy, they'll no longer be able to access the "Manage Requests" link. If we add board_assistants_team to the PERMITTED_ROLES for the UserInviteRequest policy, they won't be able to get to the "Manage Queue" link. It's not catastrophic, but it would be annoying.

<% if policy(Invitation).index? || policy(UserInviteRequest).index? || policy(InviteRequest).can_manage? %> might be bette. If that feels like overkill, we could add a comment to each of the policies telling us to check this menu if we change anything.