feat(rbac): contributor role

[jiparis]

This PR introduces a series of changes:

• Only Org admins (and owners) can query organization members
• allow to see and manage group memberships to maintainers
• allow to see and manage project memberships to project admins
• group list available to everyone
• New contributor role that implements same permissions as Org Member but they cannot create projects
• Some refactor in policies so that inheritance is used as much as possible.
• Fixed a couple of permission inconsistencies.

I've tested every single endpoint with different role combinations, and it works as expected.

Examples:
As a contributor I cannot see memberships:

✗ cldev org ls
WRN API contacted in insecure mode
┌────────┬─────────┬─────────┬─────────────┬─────────────────────────┬─────────────────────┐
│ NAME   │ CURRENT │ DEFAULT │ ROLE        │ DEFAULT POLICY STRATEGY │ JOINED AT           │
├────────┼─────────┼─────────┼─────────────┼─────────────────────────┼─────────────────────┤
│ my-org │ true    │ true    │ contributor │ ADVISORY                │ 14 Jul 25 12:52 UTC │
└────────┴─────────┴─────────┴─────────────┴─────────────────────────┴─────────────────────┘
➜  cldev org member ls
ERR operation not allowed
exit status 1

As a contributor and project admin I can create project-scoped tokens:

➜  cldev org api-token create --name test-$RANDOM
ERR project is required
exit status 1
➜  cldev org api-token create --name test-$RANDOM --project sarah
┌──────────────────────────────────────┬────────────┬───────────────┬─────────────┬─────────────────────┬────────────┬────────────┬──────────────┐
│ ID                                   │ NAME       │ SCOPE         │ DESCRIPTION │ CREATED AT          │ EXPIRES AT │ REVOKED AT │ LAST USED AT │
├──────────────────────────────────────┼────────────┼───────────────┼─────────────┼─────────────────────┼────────────┼────────────┼──────────────┤
│ dd52ad0a-2c86-409d-885e-087fda097924 │ test-12828 │ project/sarah │             │ 17 Jul 25 16:07 UTC │            │            │              │
└──────────────────────────────────────┴────────────┴───────────────┴─────────────┴─────────────────────┴────────────┴────────────┴──────────────┘

Save the following token since it will not printed again:

...

As a contributor I cannot create a new project during attestations:

➜  cldev att init --name foo --project sarah-new --replace
This command is will run against the organization "my-org"
Please confirm to continue y/N
y
ERR you are not allowed to create projects
exit status 1

However I can as a Member:

➜  cldev att init --name foo --project sarah-new --replace
This command is will run against the organization "my-org"
Please confirm to continue y/N
y
┌───────────────────────────┬──────────────────────────────────────┐
│ Initialized At            │ 17 Jul 25 16:13 UTC                  │
├───────────────────────────┼──────────────────────────────────────┤
│ Attestation ID            │ 1993cf5a-ffda-46f6-8d5c-6b5763bcedc4 │
│ Organization              │ my-org                               │
│ Name                      │ foo                                  │
│ Project                   │ sarah-new                            │
│ Version                   │ v1.35.0 (prerelease)                 │
│ Contract                  │ sarah-new-foo (revision 1)           │
│ Policy violation strategy │ ADVISORY                             │
└───────────────────────────┴──────────────────────────────────────┘

[migmartri]

Thanks

[migmartri]

nice

[migmartri]

much nicer