Feature/cleanup rbac naming

[andreasfrisch]

🌟 Changes

• Cleaned up namespaces
• Moved system-admin permissions to other namespaces
• Changed how 'removing elevated permissions' work for cloud engineers (this will require some frontend work too I think.)

[DFDS-Snyk]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[SEQUOIIA]

With this rename, we now have an overlap of permissions. We have capability.manage-permissions for both the global and capability access type. And with how

selfservice-api/src/SelfService/Infrastructure/Api/RBAC/RbacController.cs

Lines 822 to 824 in 4d2bf02

	{
	var matching = allPermissions.First(ap => ap.Namespace.ToString() == p.Namespace && ap.Name == p.Name);
	return new RolePermissionEntry(matching.Namespace, matching.Name, matching.AccessType);

works, it'll only ever pick the first one it finds. But I guess that's more on the RbacController that should have its behaviour fixed. Not sure we carry the AccessType in that request DTO though, would still make sense to fix it here I think.

[andreasfrisch]

If I understand your concern, this should fix it: d87f8b5

It may require some frontend work, but we will not assign a permission to a wrong scope by accident at least.

[SEQUOIIA]

I'm guessing this is only for local seeding? Either way, this is a change in permissions for Capability owners. This would allow them to delete public topics, something that we haven't previously allowed people unless they are cloud engineers.

[andreasfrisch]

No, this is important.
It is primarily used for local seeding, but it can also be used by the 'bootstrapper' for rights in the system (the go script).

Will remove this