Ability to grant permission on all resources of a specific type

We should add ability to grant permissions on all resources of a specific type to the RBAC permission assignment files.

Right now, user can already grant permissions on the pack basis. This works for a majority of the use cases (e.g. ability to execute all the actions in pack Y, ability to view all the rules in pack X, etc.), but in some scenarios user may want to grant permission on all the resources of a specific type which don't necessary belong to the same pack.

Some ideas how we could handle that:

Approach 1

name: "pack_search_role"
description: "Role which grants pack_search permission to all packs"
permission_grants:
    -
        resource_uid: "packs:*"
        permission_types:
           - "pack_search"

name: "view_all_rulws"
description: "Role which grants rule_view permission on all the rules in the system"
permission_grants:
    -
        resource_uid: "rule:*"
        permission_types:
           - "rule_view"

Approach 2

In this scenario no resource_id is provided.

That's how we handle global permission types right now (permission which are global and don't apply to a specific resource) so doing that for all the resources could be confusing and we should probably avoid it.

name: "pack_search_role"
description: "Role which grants pack_search permission to all packs"
permission_grants:
    -
        permission_types:
           - "pack_search"

If we go with the first approach, we should probably implement simple "all or nothing" glob matching to being with.

Down the road, we could implement more complex glob matching, but I'm not a big fan of it since it's more complex, opaque and and has negative performance implications in case of complex glob patterns.

One thing which I'm 100% against is using regular expressions instead of globs. I would argue that regular expressions should very rarely be exposed to the end user (if someone exposes it, I treat is as a bad and potentially insecure UX), they increase complexity and there are many edge cases which can result in DDoS and similar resource exhaustion attacks.

Related issue #4063 and comment https://github.com/StackStorm/st2/issues/4063#issuecomment-378837810.

Start by locating the RBAC permission assignment files and reviewing related issue #4063. Compare the proposed resource UID glob approach with the alternative, then clarify matching semantics and security constraints; the work is done when a decided design is implemented and covered by relevant tests.