Refactor has_access calls to accept permission lists instead of multiple or statements

[bduke-dev]

Update all instances where an or statement is used with has_access to instead pass a list for the sec_permission parameter. For example, refactor code from:

if has_access(request.user.id, auth_obj) or has_access(request.user.id, "scoutadmin"):
    ...

to:

if has_access(request.user.id, [auth_obj, "scoutadmin"]):
    ...

Ensure all such patterns in the codebase are updated for consistency and maintainability in the update-has-access branch.