Manage attribute checks in addition to RBAC checks

Situation

In the current library's permission system, we use Bridgekeeper to implement rules that are checked at enforcement points to make decisions. Those rules are a combination of role checks with attribute/context checks.

Our current matcher only supports explicit role assignment (with the permissions of the role and with inheritance of roles).

We need a way to perform attribute/context checks at our enforcement points, ideally using Casbin.

Examples of usage

CAN_CREATE_CONTENT_LIBRARY
Conditions: global_staff or course_creator.

CAN_VIEW_THIS_CONTENT_LIBRARY
Conditions: global staff, attribute ‘allow_public_read’, explicit read permissions (admin, author, read).

References

• Libraries Roles and Permissions Migration Plan: https://openedx.atlassian.net/wiki/spaces/OEPM/pages/5252317270/Libraries+Roles+and+Permissions+Migration+Plan#Permissions-and-validations
• AuthZ Long-Term (bridgekeeper): https://openedx.atlassian.net/wiki/spaces/OEPM/pages/5210112002/Open+edX+AuthZ+Framework+Long-Term+Vision#What-about-Bridgekeeper%3F

Start with openedx/core/djangoapps/content_libraries/permissions.py and compare CAN_CREATE_CONTENT_LIBRARY with CAN_VIEW_THIS_CONTENT_LIBRARY. Review the referenced Bridgekeeper and AuthZ migration materials, plus closed pull request #101, to understand the intended direction. Done means enforcement points can evaluate both role assignments and the listed attribute/context conditions, including the global_staff, course_creator, allow_public_read, and explicit permission cases.