Support fine-grained permissions for AppProject resource

# Summary

Ability to permit token-creation for project resource, or updating specific fields.

# Motivation

Admin can use projects for user and resources isolation, using predefined roles for that. Example:
```yaml
policies:
- p, proj::admin, applications, *, //*,
allow
- p, proj::admin, logs, get, /*, allow
- p, proj::admin, repositories, *, /*, allow
- p, proj::admin, clusters, *, /*, allow
```
For now user, that allowed to use such project, will be able to add clusters, create applications, deploy resources etc., but will not be able to issue token for role which one has access. Argocd cli reports it needs `project, update` permissions for that (strangely in UI it works). So it would be great if we can give specific permissions for token-creation, maybe other fields (for example source repositories would be nice), but not whole project update.

# Proposal

Similarly to fine-grained permissions for applications we could have policy like:
```
p, example-user, projects, update/jwt-token, default/prod-app, allow
```

Start by tracing AppProject authorization and the existing fine-grained application permission handling, then compare the Argo CD CLI and UI token-creation paths. Define the policy syntax and resource scope for token creation and field updates, and verify that permitted operations work without granting whole-project update access.

Written by the indexing model from the issue text.