Annotations: Lift parts of RBAC from xorm store into auth service (#76967)

* [WIP] Lift RBAC from xorm store

* Cleanup RBAC, fix tests

* Use the scope type map as a map
* Remove dependency on dashboard service
* Make dashboards a map for constant time lookups (useful later)
---
* Lift RBAC tests into a new file to test at service level
* Add necessary access resource structs to xorm store tests

* Move authorization into separate service

* Pass features to searchstore.Builder

* Sort imports

* Code cleanup

* Remove useless scope type check

* Lift permission check into `Authorize()`

* Use clearer language when checking scope types

* Include dashboard permissions in test to ensure they're ignored

* Switch to errutil

* Cleanup sql.Cfg refs

pkg/services/annotations/accesscontrol/models.go

@@ -0,0 +1,14 @@
+package accesscontrol
+
+// AccessResources contains resources that are used to filter annotations based on RBAC.
+type AccessResources struct {
+	// Dashboards is a map of dashboard UIDs to IDs
+	Dashboards map[string]int64
+	// ScopeTypes contains the scope types that the user has access to. At most `dashboard` and `organization`
+	ScopeTypes map[any]struct{}
+}
+
+type dashboardProjection struct {
+	ID  int64  `xorm:"id"`
+	UID string `xorm:"uid"`
+}