feat(rbac): allow creating orgs to tokens with proper permissions

[jiparis]

This PR adds the ability for tokens to create organizations, if they have the "organization:create" policy associated.

I've removed the ad hoc permissions check that this endpoint used to have, and replaced with policy checks, both for users and API tokens.

See some execution logs:

With restrict_org_creation: false:

regular user (Instance Admin): allowed 🟢

✗ cldev org create --name org16
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
INF Organization "org16" created!

regular user (Org Viewer in another org): allowed 🟢

cldev org create --name org17
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
INF Organization "org17" created!

regular API token in a different org: not allowed 🔴

cldev org create --name org18
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
ERR not allowed
exit status 1

Instance Admin API token: allowed 🟢

 cldev org create --name org19
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
INF Organization "org19" created!

With restrict_org_creation: true:

regular user (Instance admin): allowed 🟢

cldev org create --name org22
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
INF Organization "org22" created!

regular user (Org viewer in different org): not allowed 🔴

cldev org create --name org23
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
ERR not allowed

regular API token from existing org: not allowed 🔴

cldev org create --name org21
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
ERR not allowed
exit status 1

Instance admin API token: allowed 🟢

cldev org create --name org20
DBG using config file path="/Users/jiparis/Library/Application Support/chainloop/config.devel.toml"
WRN API contacted in insecure mode
INF Organization "org20" created!

Closes #2704

[migmartri]

Added some comments, I'd like to get some understanding on what's the expected behavior of the org create with both token/users and restrictedCreation/non-restricted

[migmartri]

Please double check my comments

[jiparis]

Added some comments, I'd like to get some understanding on what's the expected behavior of the org create with both token/users and restrictedCreation/non-restricted

I've updated the description with some tests with and without restrict_org_description setting

[migmartri]

thanks

[migmartri]

yeah, more clear now, thanks

[Piskoo]

looks good, thanks @jiparis !