As a user, I want to see who has permissions on a specific object.

Is your feature request related to a problem? Please describe.
Right now the pulp API provides two mechanisms for checking user and group permissions on objects.

• /pulp/api/v3/groups/{pk}/roles/ -> displays all the roles that a specific group has.
• /pulp/api/v3/users/{pk}/roles/ -> displays all the roles that a specific user has.

If I want to see who has permissions on a specific repository, for example, I would need to iterate through every user and group in the system and search these two API endpoints for the object's pulp_href.

Describe the solution you'd like
The easiest solution would be to provide an api endpoint for the UserRole and GroupRole models that isn't nested under a group.

• /pulp/api/v3/user-roles/ -> lists all user roles in the system
• /pulp/api/v3/group-roles/ -> list all group roles in the system

These two API endpoints should accept the following query parameters:

• content_object: pulp object HREF. Returns all permissions for the specific object
• group or user: pulp object HREF. Returns all the permissions for the specified user/group
• role: role name. Returns all object permissions that use the given role.

Any additional filters that are already on the existing group role and user role APIs would be nice as well.

This would give users the ability to easily see who has access to what resources, which is helpful for building UIs and performing security audits.

Additional context
Right now we solve this problem in galaxy_ng by building custom APIs around roles that are assigned to objects. I would like to be able to get rid of these custom solutions an use the pulp APIs instead, since this would give our users much better visibility into all the objects in the system and not just the ones that we expose via the galaxy api.

Start by reviewing the existing /groups/{pk}/roles/ and /users/{pk}/roles/ APIs and the UserRole and GroupRole models named in the request. Define the un-nested endpoints and filtering behavior for content_object, group or user, and role; done means users can query permissions for a specific object and identify its users or groups.