Role-Binding V2

[bailinhe]

continue work on #219

The API should be updated to use them in place of direct role assignments. The scope of this task is to make the following API changes:

Roles

Create appropriate action relationships from the roles to subject:* type relationships rather than relationships from other resources to the roles

Assignments

Create a binding when creating an assignment rather than creating a direct membership to the role

List both bindings and direct memberships when listing assignments (and show an ID for bindings)

Delete both bindings and direct memberships when deleting assignments

Check permissions based on binding_{create,get,update,delete} actions rather than role-specific actions

See this OpenAPI specs for full list of APIs