Header Images: fix cropping for users without the 'customize' capability

[mattwiebe]

I think I found a Core bug here. There's absolutely no reason for the ajax request to include wp_customize=on, the logic is entirely handled in the wp_ajax_crop_image() handler.

This commit appears to have moved the logic from the Customizer into a more general purpose context while leaving the constraining wp_customize=on parameter.

I guess this could be a core patch

Fixes #846

Proposed changes:

Make a custom controller but without wp_customize=on

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

1. Be logged in as an author-level user (or any other user who can create posts but not edit others' posts)
2. Ensure that this user is ActivityPub-enabled
3. Go to profile and attempt to upload and crop an image. Any image uploaded or chosen from the library should work (the library will now only show the author user's own posts)

[mattwiebe]

I fixed the remaining problem in 3000bf5 - you can't crop an image that you didn't upload when you can't edit others' posts, failing this check that supplies the nonces.

This is definitely ready for testing again @pfefferle

[pfefferle]

works like a charm!