Operator & all-access permisions are invalidated when new resource types are added

The front-end/docs of our auth system talk about 2 special-case token types:
1. "All-access" tokens have read+write access to all resource types within a single organization
2. "Operator" tokens have read+write access across the entire DB

On the back-end/persistence layer, these token types don't actually have a special representation; instead, whether or not a token is all-access/operator is determined by the contents of its permissions list at runtime.

When we add new resource type(s) to the server, we change the definition of an all-access/operator token. Existing tokens that used to have these roles lose that property, because their persisted permissions lists don't include read+write entries for the new resource type(s). We've seen this break APIs for users when they upgrade between versions of 2.x (for example, #16120 shows that backup breaks after an upgrade because only an operator can use the backup API).

No files, tests, or entry points are named. Start by tracing how persisted permission lists are interpreted for all-access and operator tokens, then define how adding resource types should preserve those roles and verify that upgraded existing tokens retain access to APIs such as backup.

Written by the indexing model from the issue text.