RBAC: Adjust filter for acl list to check for permissions on service accounts

[kalleep]

What is this feature?
When we added support for service account in acl list we never adjusted the permissions filter to look for correct permissions for service accounts. Because of this a user could only list service account if they could read all users or could read a service account with a user scopes (this should not be possible).

I adjusted the filter to look for different permissions depending on if the user is marked as a service account or not.
This query is quite large and complex and I wonder if we should move out the filter from the query and check it on the service layer manually instead.

Which issue(s) does this PR fix?:
Fixes https://github.com/grafana/identity-access-team/issues/487

Special notes for your reviewer:

Please check that:

• It works as expected from a user's perspective.
• If this is a pre-GA feature, it is behind a feature toggle.
• The docs are updated, and if this is a notable improvement, it's added to our What's New doc.

[IevaVasiljeva]

Thanks for fixing this! I agree that the query is getting pretty long, but I think it's still quite readable, so I think I vote for sticking with this approach for now (it also feels consistent with how we filter resources in most other places).

[gamab]

LGTM :)