Update record permission policy

• fix preview permissions not granting access to the draft's files if they are restricted
• also refactor the permission levels for shared access (links & grants) to be easier to handle
• the latter unfortunately introduces duplicate generators in the policy and is thus a bit wasteful - if that turns out to be a problem, that should be updated in the future (e.g. via sets)