Think through the security of Undelete

Summary: The undelete capability is quite powerful, especially now that undeleteThing() exists. It's arguably too powerful. Figure out what the rules should be, and implement them.

This is really fairly tricky.

On the one hand, we don't want to simply allow open season on it; otherwise, it would be impossible for the Managers to delete objectionable content.

OTOH, we can't only allow Managers to undelete stuff, or the original use case for undelete -- recovering after an accidental deletion -- wouldn't work.

So this probably needs to be kind of nuanced. If I deleted something, I should be allowed to undelete it. If I'm a Manager, I should be able to undelete anything. Otherwise, I probably shouldn't be allowed to undelete. Right?

Regardless, this needs to be implemented inside the guts of handing RestoreDeletedThing() in SpaceHistory, so that we catch both the QL and UI approaches to undelete.