Check REST-API role permissions

[Christoph-Meyer]

Some REST-API URLs should not be callable when the logged in user does not have the right role.

E.g. the following Controllers with the fitting services need to be secured/checked with @PreAuthorize and a fitting role needs to be added to the DB table "Permission":

• Quest creation, progression and deletion
• Adventure creation, progression and deletion
• Task creation and handling
  etc.

Basically all available REST URLs need to be reviewed and a fitting role needs to be assigned where necessary.
Additionally to document the changes a table listing the Roles and Permissions should be added to the GitHub documentation.