MDL-82502 courseformat: align module action capability checks.

The "Hide/Show/Duplicate" actions should be considered self-contained,
and not also require "manageactivities" capability (per existing docs)
in addition to the specific capability that controls the action itself.

Also ensure the "Duplicate" capability checks are in the course context.

course/mod.php

@@ -122,8 +122,8 @@ if (!empty($add)) {
      $course = $DB->get_record('course', array('id' => $cm->course), '*', MUST_EXIST);
 
     require_login($course, false, $cm);
-    $modcontext = context_module::instance($cm->id);
-    require_capability('moodle/course:manageactivities', $modcontext);
+    $coursecontext = context_course::instance($course->id);
+    require_all_capabilities(['moodle/backup:backuptargetimport', 'moodle/restore:restoretargetimport'], $coursecontext);
 
     // Duplicate the module.
     $newcm = duplicate_module($course, $cm);