Rework permission scheme (authorization)

[FRosner]

Problem

Currently you have predefined roles (admin, operator, user) and also the instance regex. Also, one user can only have one of each.

Solution

Make permission scheme more modular.

• A user belongs to one or multiple groups
• A group has no or multiple permissions assigned
• Permission types are predefined, but each permission might be associated with additional information when assigned to a group (e.g. the instance / template filter through regex)
• Regexes are defined by the user and are reusable (Are they maybe better handled through input validation based on groups Input validation #199?)

Also we should give a usable example (ship it with the dist?)

• Admin group
• Operator group
• User group

Permissions

Parameter arguments should be optional if possible with a sane default (e.g. no filter). Filters should be implemented to be as flexible as possible (e.g. regex).

• create instance (instance filter, template filter)
• edit instance (instance filter, template filter, parameter filter)
• delete instance (instance filter, template filter)
• update instance (instance filter, template filter)
• view instance (instance filter, template filter)
• view template (template filter)
• start/resubmit instance (instance filter, template filter)
• stop instance (instance filter, template filter)