Security Fixes for 3.9.8

[Anindra123]

Issue 1

• The action tutor_update_course_content_order which allows to change the order of the lesson inside a topic, a payload can be passed tutor_topics_lessons_sorting which takes topic_id and array of lesson id
• No check is given for the payload tutor_topics_lessons_sorting on whether the user can edit the topic, thus allowing subscribers to modify topic id, add other lessons etc.
• To fix this i have added the check for the topic id using the method tutor_utils()->can_user_manage( 'topic', id );

Issue 2

• For both enroll_now and course_enrollment method inside Course.php class there is check whether the course is paid course but there is not check whether the course is private, thus users can enroll in private courses through ajax call.

• To fix this i have added private courses check on both of the methods.