Expose session's macaroon and/or full permission list

Nobody has claimed this yet.

In an effort to save people's feet from their own guns, we like to make sure they give us minimally permissible credentials to do what they want us to do.

The only API `lnc-web` exposes for permissions are `hasPerms` and `isReadOnly`. If we wanted to make sure a session only allows us to send offchain payments for instance, we'd need to make sure `hasPerms` returns false for every other possible permission the session could have.

Something like a `listPermissions`, or `macaroon` function even, would allow us to more efficiently/effectively do this check.

For reference, our lnd auto-withdrawals using the old fashioned non-TURNed configuration validate the macaroon by decoding it clientside and making sure the ops are strictly limited to either:

the ideal:
```js
const INVOICABLE_MACAROON_OPS = [
{
entity: 'invoices',
actions: [
'read',
'write'
]
}
]
```

the prebaked invoice macaroon:
```js
const INVOICE_MACAROON_OPS = [
{
entity: 'address',
actions: [
'read',
'write'
]
},
{
entity: 'invoices',
actions: [
'read',
'write'
]
},
{
entity: 'onchain',
actions: [
'read'
]
}
]
```

Start by tracing the existing hasPerms and isReadOnly APIs in lnc-web and review how sessions represent macaroons and permissions. Decide whether exposing a listPermissions or macaroon API best supports checking exact permission sets, then verify it can distinguish the example invoice-only operations from broader credentials.

Written by the indexing model from the issue text.