Granular access control

[byewokko]

Seacat Admin API could use more granular access control. At the moment, most calls are either non-superuser or superuser-only. It should differentiate between read and write operations in the individual sub-APIs (tenant, role, credentials...)

Describe the solution you'd like

• [x] Implement the following resources

Section	READ	EDIT	(SOFT) DELETE	OTHER
Credentials	seacat:credentials:access	seacat:credentials:edit	seacat:credentials:edit	--
Tenants	seacat:tenant:access	seacat:tenant:edit	seacat:tenant:delete	seacat:tenant:assign, seacat:tenant:create
Sessions	seacat:session:access	--	seacat:session:terminate	--
Roles	seacat:role:access	seacat:role:edit	seacat:role:edit	seacat:role:assign
Resources	seacat:resource:access	seacat:resource:edit	seacat:resource:edit	--
Clients	seacat:client:access	seacat:client:edit	seacat:client:edit	--

• [x] Make sure they are initialized by the ResourceService.
• [x] Resource authz:tenant:admin is obsolete and should be deleted.

[byewokko]

Resource seacat:tenant:create is not in use for now, creating users still requires superuser rights.