ref ENG-728
ref https://linear.app/tryghost/issue/ENG-728

The loadedPermissions were only used to check roles or whether an api key was
used. The later is already exposed on the `context` object, so we just need
to pass the role. This allows us to internally change how permissions are
loaded without having downstream effects, it also moves us closer to pulling
roles out of the db and into hardcoded strings.