audit the permissions required to modify a resource's policy

Creating this ticket for https://github.com/oxidecomputer/omicron/blob/b062e95f5f917909b8c6d40200a4d0d80847694f/nexus/src/db/datastore/role.rs#L239-L240

(edit: this comment was removed under https://github.com/oxidecomputer/omicron/pull/2417 but the issue remains)

Internally, there's an explicit authz action for ModifyPolicy. Who should get it? Right now, it's precisely anyone who can modify the resource:
https://github.com/oxidecomputer/omicron/blob/b062e95f5f917909b8c6d40200a4d0d80847694f/nexus/src/authz/oso_generic.rs#L211

For resources covered by the roles policy test, you can see which roles are able to modify the resource's policy in this output file (the "MP" column):
https://github.com/oxidecomputer/omicron/blob/b062e95f5f917909b8c6d40200a4d0d80847694f/nexus/tests/output/authz-roles.out

We should make sure that's right.

Start with nexus/src/db/datastore/role.rs around lines 239-240 and nexus/src/authz/oso_generic.rs around line 211 to understand the ModifyPolicy authorization path. Compare the MP column in nexus/tests/output/authz-roles.out for resources covered by the roles policy test. Done means the required roles for modifying each resource policy have been audited and any incorrect assignments are addressed.