Access control: Setup CanCanCan for API

**Description**
Skills used to be a Frontend and Backend Application this was changed later.
But all the API controllers still exist as we decided to keep them if we ever need them.
If we use those controllers again make sure to implement CanCanCan like its done everywhere else.

**TODO**
- [ ] Implement CanCanCan for all controllers
- [ ] Tests
- [ ] Update CHANGELOG.md
