Update record permission policy
- fix preview permissions not granting access to the draft's files if they are restricted
- also refactor the permission levels for shared access (links & grants) to be easier to handle
- the latter unfortunately introduces duplicate generators in the policy and is thus a bit wasteful - if that turns out to be a problem, that should be updated in the future (e.g. via sets)