ACL design of dashboard

## Issue Description
Version 1.6.0 introduces authorization and it's an awesome feature. That helps `dashboard` to be more complete.

My discussion here is focused on the actual authorizing design.

## Interface Design
First i think here is a little fuzzy on `AuthUser. authTarget`.

```java
/**
* Query whether current user has the specific privilege to the target, the target
* may be an app name or an ip address, or other destination.
*

* This method will use return value to represent whether user has the specific
* privileges to the target, but to throw a RuntimeException to represent no auth
* is also a good way.
*

*
* @param target the target to check
* @param privilegeType the privilege type to check
* @return if current user has the specific privileges to the target, return true,
* otherwise return false.
*/
boolean authTarget(String target, PrivilegeType privilegeType);
```

If throwing an exception is an option it's better to include in declaration like:

```java
boolean authTarget(String target, PrivilegeType privilegeType) throws RuntimeException;
```

But i don't think it's a good idea throwing an exception because we have `a boolean value returned` already to mark it success or fail.

## Integrating
For function integrating we can find following lines everywhere:

```java
AuthUser authUser = authService.getAuthUser(request);
authUser.authTarget(app, PrivilegeType.READ_RULE);
```

It includes two intents:
1. Get the current logged user information
2. Check if he has the specific privilege.

But it's a little inconvenient. I have a proposal on it like:

```java
@AuthAction(privilege = PrivilegeType.READ_RULE)
@GetMapping("example")
public String action() {
}
```
or

```java
@AuthAction(app = app, privilege = PrivilegeType.READ_RULE)
@GetMapping("example")
public String action() {
}
```
or even a parent privilege like

```java
@AuthAction(privilege = PrivilegeType.RULES)
@RequestMapping("/rules")
@Controller
public class RulesController() {
}
```

When you want user information we can inject it by `Spring Argument Resolver` like:

```java
@AuthAction(app = app, privilege = PrivilegeType.READ_RULE)
@GetMapping("example")
public String action(AuthUser authUser) {
}
```

I think we can make more discussions.

Start by reviewing AuthUser.authTarget and the AuthService.getAuthUser(request) usage shown in the issue. Compare the proposed AuthAction annotation and Spring Argument Resolver approaches, then identify the dashboard entry points affected. Done requires an agreed authorization design and an explicitly scoped implementation plan; no file or test is named.

Written by the indexing model from the issue text.