Grant leave access based on document read permission

Leave Application access was incorrectly checking for leave_approver instead of respecting workflow-based reviewer permissions.