Define a `:see-application` permission in rems.application.master-workflow

#2302 limited draft visibility by changing the `rems.application.model/see-application?` function. An alternative would be to define a `:see-application` permission (similarly to our `:see-everything` permission) which would control the application visibility.

Start by reading rems.application.master-workflow and compare its permission handling with the existing :see-everything permission. Trace the current rems.application.model/see-application? behavior and determine where application visibility is enforced. Done means a defined :see-application permission controls application visibility consistently.

Written by the indexing model from the issue text.