feat(rbac): RBAC foundation

[jiparis]

This PR includes:

• RBAC logic to apply fine grained permissions when user has role:org:member role on the organization. Regular roles don't get this logic applied
• A new membership entry is added when a project is created (making the caller user owner of the project)
• All endpoints where RBAC should be applied, have been adapted to query for "visible" projects

There is only one endpoint set that needs more work, or perhaps they should be maintained outside the scope of RBAC:

• Org API token management: currently only available to Org Admins. With the current implementation, Org Members won't be able to generate tokens (unless we move or support project-scoped API tokens)

Note that this PR is safe to merge, since existing roles still work in the same way.

Refs #2121

[migmartri]

I made it work, looking good :)

Some minor issue is that I found some inconsistency between the message we get from the middleware and potentially from the one from the new helper, for example

go run main.go cas-backend ls
WRN API contacted in insecure mode
ERR operation not allowed

and

go run main.go att init --name test-annotations --project project-sarah  --replace
Flag --name has been deprecated, please use --workflow instead
WRN API contacted in insecure mode
This command is will run against the organization "foobar-222"
Please confirm to continue y/N
y
ERR user not authorized

[migmartri]

@jiparis one thing that you didn't end up adding I think is the cache we talked about when retrieving memberships, etc. Are you still going to do it?

[jiparis]

@jiparis one thing that you didn't end up adding I think is the cache we talked about when retrieving memberships, etc. Are you still going to do it?

Yes, it's added for 10 seconds.

[migmartri]

LGTM