ability.rb is fundamentally (kinda) broken

[orenyk]

So, while reviewing #1350 we ran into an issue where we needed seemingly duplicate statements in ability.rb to handle checkout person authorization despite the fact that it appeared as it should be definable in just one when block. Unfortunately, due to the way Ruby case statements work, we're never actually getting into that when block for checkout persons. Fortunately, all of the abilities in that block are subsets of abilities in the matching checkout person block, so we haven't ever noticed this fact.

We should refactor ability.rb to properly handle role inheritance (this seems like a good setup) so that everything is cleaner and makes more sense.