fix: the authorizer plugins call HasPermission correctlyThe controller admin and model permission authorisers were calling common.HasPermission withoutaccounting for the fact that the access func passed in would be called with everyone@externalfor non local users. So the check that the entity equals the user was invalid.

fix: backport various ci test fixes from 3.6