DRY up things a little by having a BoardPolicy that knows how to
delegate to Project or Group depending on parent type instead of having
`group#group_board?` calls everywhere