Merge keypair resource policy into user resource policy

## Motivation

- Keypair is now a volatile authentication token, where a single user may have multiple keypairs depending on the service realm.
- In the future, we are going to use keypairs to track the access source of first-party/third-party services whose SSO is integrated with the core.
- The user-related settings, profiles, policies should be bound to the user instance, not its keypair instances.

## Required Work

- Database migration plan with thorough backup
- Move/merge the current keypair resource policy config API & UI to the user resource policy

## Impact

- This may be a BREAKING CHANGE for some usecases or setups.
- We need to educate the APC team and customers.

JIRA Issue: BA-2555