Fetch minimal set of fields when doing only permissions checks

[petli]

Most of the Media operations on works in modules/core/lib/work.js need to get the work to check permissions, and possibly also Work.media to be able to manipulate the list. The relevant calls to db.Work.findByIdAsync should add the parameter to select the minimal set of fields to avoid dragging in annotations etc.

Better list the permission fields as a constant, refering to it later, to make it easy to add as we extend the permission system.

Current list of affected functions are:

• getWorkMedia
• createWorkMedia
• removeMediaFromWork
• unlinkAllMedia
• addMediaToWork