[2.x] fix: allow non-admins to upload a poll image before the poll exists

[imorland]

Fixes #131 — reported by @ekumanov, who also diagnosed the cause.

The bug

Adding an image to a poll while creating it returned 403 for every non-admin, no matter which permissions they held. Editing an existing poll's image worked, because that path takes the if ($pollId) branch and correctly checks assertCan('edit', $poll).

The composer uploads the image before the poll is saved, so on that path there is no model to authorize against. It asserted:

$actor->assertCan('startPoll');
$actor->assertCan('startGlobalPoll');

startPoll is a policy ability on Post (Access\PostPolicy::startPoll). With a null model, core's Gate::allows() only consults GLOBAL policies — so the Post policy is never evaluated — and falls through to:

return $actor->isAdmin() || $actor->hasPermission($ability);

startPoll is never registered as a grantable permission (the admin extender registers startGlobalPoll, uploadPollImages and startPollGroup), so hasPermission('startPoll') is always false and only the isAdmin() branch could ever pass.

The two asserts were also AND-ed, so even where the first check passed, a user creating a discussion poll was required to hold startGlobalPoll as well.

The fix

Both controllers now share assertCanStartAnyPoll(), which permits the upload when the actor can start a global poll or holds discussion.polls.start — the grantable permission the canStartPolls forum attribute already uses. uploadPollImages is still asserted first, so the upload stays behind both "may upload poll images" and "could actually be creating a poll".

On the design question left open in the issue: I kept the poll-start requirement rather than letting uploadPollImages stand alone, since the request writes a file to disk and the second check keeps that tied to a plausible poll.

Note that UploadPollOptionImageController overrides handle() and carried its own copy of the same broken branch, so option images were affected identically.

Tests

New UploadPollImageAuthorizationTest covers the pre-save upload path for both poll and option images, the admin case, and a user who may upload but cannot start a poll anywhere (403).

Proven red first: the two pre-save cases return 403 against the current controllers and 200 with the fix, while the negative and admin cases hold in both directions. Full suite 122/122, PHPStan clean.