Check read permission on lead in add_lead_to_prospect

The method wasn't checking whether the user could read the lead before converting it to a prospect.