Fix /-/check 500 error on query-scoped actions

[truffle-dev]

Closes #2756.

_check_permission_for_actor builds child-level resources with hardcoded table=child, which raises TypeError for QueryResource (it accepts query=, not table=). Visiting /-/check?action=delete-query (or view-query, update-query) returned a 500.

Switched the call to positional args so it works with every Resource subclass regardless of the second-parameter name.

Verification: with the fix reverted via git stash, the three new parametrized cases reproduce the original TypeError; restoring it makes them pass. Full tests/test_permissions.py and tests/test_actions_sql.py runs are green.