Loosen authorization rule for recoverty token search

The authorization to read recovery tokens (RT) for ones institution was set
to require the RAA role. However, reading and removing RT is a RA
action.

This commit lowers authz to RA for searching the RT

See: https://www.pivotaltracker.com/story/show/184938232

src/Surfnet/StepupMiddleware/ApiBundle/Controller/RecoveryTokenController.php

@@ -99,7 +99,7 @@ public function collectionAction(Request $request)
             $actorId = new IdentityId($actorId);
             $query->authorizationContext = $this->authorizationService->buildInstitutionAuthorizationContext(
                 $actorId,
-                RegistrationAuthorityRole::raa()
+                RegistrationAuthorityRole::ra()
             );
         }
         $paginator = $this->service->search($query);