Hide bounty actions from unauthorized org viewers

[lizardflaco]

Fixes #238.

What changed

• Hide the org bounty edit/delete action group unless the current viewer has an org :admin or :mod role.
• Keep the existing server-side authorization in place for edit-bounty-amount and delete-bounty events.
• Add LiveView coverage for non-member viewers and org admins on the org bounties page.

Verification

• git diff --check
• Not run: mix test test/algora_web/live/org/bounties_live_test.exs because mix is not installed in this local environment.

Notes

• Scoped to the EarnOps candidate issue.

[CLAassistant]

All committers have signed the CLA.