Non-atespace grouping of actors for identity, policy and federation #3713

Summary

Add a way to group actors at more than one level (for example prod / project-x / alice), and let authorization, egress and ingress policy, and the actor's identity claims refer to those groups.

Motivation

The atespace is the only grouping that Substrate's authz, policy and identity understand. The actor JWT and certificate carry atespace, name and UID. So:

• External relying parties that federate actor identity can only grant to one atespace, or to one actor. Per-actor grants don't scale. Grants per ate-space are OK but atespace groupings will also be needed for infrastructure tasks, like quota management. Those infrastructure groupings may not always make sense as authorization groups.
• [Feature Proposal] Support for Labeling and Filtering Substrate Entities #186 adds labels for filtering and listing. Those labels are set by whoever writes the actor and aren't a security attribute, so they can't safely drive policy or appear in identity claims as-is.

Rough Requirements

• Membership is a security attribute. Only a principal with rights on the group may put an actor in it, and it can't change for the actor's lifetime (or a change has to invalidate the actor's issued credentials). Otherwise an atespace editor could put an actor into a privileged group.
• It reaches the identity. Group membership appears in the actor JWT (and the certificate if needed) in a form external relying parties can map to attributes. Keep it compact, because some relying parties cap subject and attribute lengths at around 127 bytes.
• Policy can select on it. OpenFGA authz, egress policy and (future) ingress policy can target a group, not just one atespace.
• No new hot path. Resolving membership can't burden the control plane.