Update frontend and backend to give proper permissions to users with the editRestricted role

[juhanikat]

The EditRestricted role doesn't have proper permissions to do things across the site. Also, some things are allowed in the frontend (an EditRestricted user can click an edit button, for example) but not in the backend (the route sends a 403 error).

Examples:

Users with the EditRestricted role should only be able to create or update localities which are in the same project with the user. Otherwise they should have reading rights only. Current behaviour: Users with the EditRestricted role can access the edit view in their own localities, but sending the PUT request to the backend fails because the role doesn't have permissions.

Users with the EditRestricted role should be able to create and update species. This is currently not possible.
Current behaviour: Users with the EditRestricted role can access the editing/creating new species view from the frontend, but sending the PUT request to the backend fails because the role doesn't have permissions.