Removes requirement of datasources:query permission for reading rules

Fetching a rule group no longer requires the datasources:query permission for every data source used by the rules within that group. Now, the only requirements are alert.rules:read and folders:read for the folder the group is contained in.

Note: datasources:query is still required to preview an alert rule, regardless of alert rules and folders permissions.