Refactor document_grant_access to use shared code for resolving public keys

As of #27 `resolve_keys_for_grants` now exists and is shared between `encrypt_document` and `edek_encrypt_document`. It seems like this new function could also be used in `document_grant_access` as well.

It may make sense to combine this work with that of #18

Start by reading resolve_keys_for_grants and the existing uses in encrypt_document and edek_encrypt_document, then inspect document_grant_access. Review issues #27 and #18 for context; done means document_grant_access uses the shared key-resolution code without changing its behavior.

Written by the indexing model from the issue text.