Make X-MS-API-ROLE optional

DAB currently requires developers to provide `'X-MS-API-ROLE' : 'admin'` as a header when making their requests. However, this is not intuitive for new users, and this is inconvenient for all developers. They expect the role to be used to be assumed as the highest priority, especially when they only consider RBAC (for ex, if I have both authenticated & admin, I want DAB to use admin assuming it has higher permissions).

RBAC should not require the specification of `'X-MS-API-ROLE' : 'admin'`.

I understand that the explanation provided to me was that, while we can determine the 'most permissive role' for RBAC that the user has (according to the permissions in the config), we cannot determine the most permissive policy in case a policy is applied to a role.

One method I propose is that, if policies apply to the specific query the customer made, we respect the order of the permissions as specified in the config file & match the first policy, with the option to override with the `X-MS-API-ROLE` header.

This solution would not remove any current functionality, while leaving the `X-MS-API-ROLE` header reserved for more advanced use cases (policy matching).

このIssueではファイルやテストが指定されていません。まず既存のRBACとポリシー選択の動作を追跡し、設定された権限の順序とX-MS-API-ROLEのoverrideがどのように連携すべきかを明らかにしてください。RBACリクエストがヘッダーなしで動作しつつ、高度なポリシーマッチングでは引き続きヘッダーを使用できれば完了です。

索引モデルが issue の本文から書いたものです。