fix: Macros authorizations (#5779)

Macros policy update.

ref: #5730

app/policies/macro_policy.rb

@@ -8,22 +8,34 @@ class MacroPolicy < ApplicationPolicy
   end
 
   def show?
-    true
+    @record.global? || author?
   end
 
   def update?
-    true
+    author? || (@account_user.administrator? && @record.global?)
   end
 
   def destroy?
-    true
+    author? || orphan_record?
   end
 
   def execute?
-    true
+    @record.global? || author?
   end
 
   def attach_file?
     true
   end
+
+  private
+
+  def author?
+    @record.created_by == @account_user.user
+  end
+
+  def orphan_record?
+    return @account_user.administrator? if @record.created_by.nil? && @record.global?
+
+    false
+  end
 end