Individual document sharing with permissions (#5814)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Tom Moor <tom@getoutline.com>

server/policies/userMembership.ts

@@ -0,0 +1,9 @@
+import { User, UserMembership } from "@server/models";
+import { allow } from "./cancan";
+
+allow(
+  User,
+  ["update", "delete"],
+  UserMembership,
+  (user, membership) => user.id === membership?.userId || user.isAdmin
+);