Add Rspec allow_action matcher for policies

Allows policy debug information to be shown if the test fails,
instead of just showing true/false.

Usage: it { is_expected.not_to allow_action(:read_group) }

spec/support/matchers/policy_matchers.rb

+# frozen_string_literal: true
+
+RSpec::Matchers.define :allow_action do |action|
+  match do |policy|
+    expect(policy).to be_allowed(action)
+  end
+
+  failure_message do |policy|
+    policy.debug(action, debug_output = +'')
+    "expected #{policy} to allow #{action}\n\n#{debug_output}"
+  end
+
+  failure_message_when_negated do |policy|
+    policy.debug(action, debug_output = +'')
+    "expected #{policy} not to allow #{action}\n\n#{debug_output}"
+  end
+end