RSDK-14415 Authorize user invocations based on user_permissions

[Benjamin Rewis (benjirewis)]

RSDK-14415

What

Enforces the user_permissions section of a machine's auth config as described in the scope.

• Adds UserPermission, User, and Permission structs to config
• Adds a userPermsAuthorizer (robot/web/authorization.go) that builds per-user permission tables from the config and enforces them via gRPC unary and stream interceptors

When user_permissions changes, tears down gRPC and WebRTC streams that are no longer permitted.

Why

Motivation from scope:

Our authorization mechanisms are too coarse. For example, an "Owner" of a machine should be able to give access to another user without them being able to see the live feed of every camera on the device. Similarly, a user should be able to get the readings from a base’s sensors without being able to actuate the base itself.

Enforcement semantics:

• If user_permissions is undefined or empty, no client is restricted (today's behavior)
• Once defined, users are identified by the API key ID or e-mail they authenticated with. Users without an entry are fully restricted unless a default user is defined; unauthenticated clients are always fully restricted; a user with multiple entries is fully restricted and an error is logged
• Methods not associated with a single resource (RobotService methods, ListStreams) match only grants under the special _machine resources string
• Streaming RPCs only get authorized on the stream's first received message

Testing

• Adds robot/web/authorization_test.go and robot/impl/user_permissions_e2e_test.go

[Description generated by Claude 🤖]

[Benjamin Rewis (benjirewis)]

For viamrobotics/api#885.