Authorization subject dependent objects injection

[buszu]

Extracted from #1.

It's pretty easy to add support for explicit context though, e.g.:
ruby authorize! record, context: { user: @user }

I think this is what I was looking for.
Some code that might be written (partially inspired by real app that's using pundit):

class RequirementsDocPolicy
  def create?
    user.documenter?(project) &&
      (user.requirement_doc.blank? || user.requirement_doc.versions.empty?) &&
      project.document_set.state == 'preparing' &&
      user.google.uploader? # assume this makes API call
  end
end

(And now imagine not using ActiveRecord.)
We need to fetch a lot of entities actually (user, project, document_set) and make external API call.

class RequirementsDocsController
  def create
    find_user_in_google
    authorize! RequirementsDoc, context: { user: current_user,
                                           user_in_google: @user_in_google }
  end
end

If I can do so, it's ok. :)