clean up Polar file: minor functional changes

[davepacheco]

This follows on #1112 but makes some (very small) changes to the policy file:

• The Database shouldn't bother with roles, and more generally none of the synthetic resources should. I think it's confusing to use roles to define the policy for things where we don't actually support assigning those roles.
• Organization should have a viewer role. I didn't bother with this initially but at this point it's unnecessarily error-prone not to have it because the definitions of Organization and Project were very subtly different from each other. Now, the definitions of Silo, Organization, and Project are basically identical aside from the parent relationship type.

[davepacheco]

I initially thought I could remove the "external-authenticator" role, but this is one that we assign via the database.

[plotnick]

This change makes the roles across the resource hierarchy much more symmetric, which I think helps make them much more understandable.

[plotnick]

Great. I mentioned the previous asymmetry in a comment on #1110, glad to see it go away.

[plotnick]

Untested, but should work:

Suggested change

	has_permission(actor: AuthenticatedActor, "modify", _resource: Database)
	if actor = USER_DB_INIT;
	has_permission(USER_DB_INIT, "modify", _resource: Database);

[davepacheco]

Neat! I'll try that in my follow-up where I'm adding some policy tests.

[davepacheco]

Interestingly, that gave me:

thread 'authz::policy_test::test_iam_roles' panicked at 'initializing Oso: loading Polar (Oso) config

Caused by:
    Invalid rule: has_permission(USER_DB_INIT, "modify", _resource: Database{}); Must match one of the following rule types:
    
    has_permission(actor: Actor{}, _permission: String{}, resource: Resource{});
    	Failed to match because: Parameter `USER_DB_INIT` expects a Actor type constraint.
    
    	USER_DB_INIT: Actor
     at line 331, column 1:
    	331: has_permission(USER_DB_INIT, "modify", _resource: Database);
    	     ^
    ', nexus/src/authz/context.rs:33:54

but if I make it:

has_permission(USER_DB_INIT: AuthenticatedActor, "modify", _resource: Database);

that seems to work.