Provide a way to filter out `infra` grants in the `/api/grants` API

[jmorganca]

Infra's clients (Dashboard and CLI) need to filter out grants that assign access to infra (i.e. Infra API itself), but there isn't an easy way to do this in the API.

The GET /api/grants endpoint should hide these grants by default, and allow for showing them via ?showSystem=true (similar to what is used elsewhere) or ?showInfra=true.