Granular Role Permissions

The standard AzureTRE roles don't fit some organisations roles and responsibilities or use cases.

We would like to see more granular RBAC permissions within the TRE as follows :-
Researcher
++ Can log onto all VM's within a workspace
++ Can view workspace cost API
-- Can't create airlock requests
-- Can't view airlock request
-- Can't create VM's
Workspace Owner
++ Can log onto all VM's within a workspace
++ Can create VM's within a workspace
++ Can view workspace cost API
-- Can't view airlock request
-- Can't create airlock requests
Airlock Data Engineer
++ Can log onto all VM's within a workspace
++ Can create airlock requests
++ Can view airlock request
Airlock Manager
++ Can log onto all VM's within a workspace
++ Can create VM's within a workspace
++ Can approve airlock requests
-- Can't create airlock requests

We have considered approaching this separately via both organisations using their own forks but to ensure we have a consistent approach and so that it can benefit the community its best approach this centrally.

We need to raise this Git request to ensure that organizations are aware of it and can incorporate it into their current decision-making and roadmap.

No files, tests, or entry points are identified. Start by locating the existing standard AzureTRE role definitions and permission checks, then compare them with the requested Researcher, Workspace Owner, Airlock Data Engineer, and Airlock Manager capabilities. Done means the requested role boundaries are implemented and verified without granting prohibited actions.