[TM-1759] add policy for sitepolygon

[egrojMonroy]

No description provided.

[roguenet]

This will break the research service account's access. The only permission it has is polygons-manage.

These should be two separate checks:

if (this.permissions.includes("polygons-manage")) {
  this.builder.can("manage", SitePolygon);
}

if (this.frameworks.length > 0) {
  ... put site UUID stuff here.
}

This brings the framework permissions approach in line with other policies, and also removes the need for your PHP PR.