Limit access to Assign Action field

With danger of posting a bug rapport without correct insight on Quiz and Drupal actions. #:-)

It appear to raise security concerns that all actions are available to users with access to post quizzes. I suggest that only users with 'administer actions' should be granted to access the field as a minimum, or a more fine grained access control could be put in place.

E.g. add an if clause around the $form['aid'] in quiz_form in quiz.module, line 577, that check user permissions.

Right now it seems that we have users with limited permission having access to delete users, comments and nodes through actions functions. As a workaround we just disable the field with form_alter.