Annotations: Lift parts of RBAC from xorm store into auth service (#76967)

* [WIP] Lift RBAC from xorm store

* Cleanup RBAC, fix tests

* Use the scope type map as a map
* Remove dependency on dashboard service
* Make dashboards a map for constant time lookups (useful later)
---
* Lift RBAC tests into a new file to test at service level
* Add necessary access resource structs to xorm store tests

* Move authorization into separate service

* Pass features to searchstore.Builder

* Sort imports

* Code cleanup

* Remove useless scope type check

* Lift permission check into `Authorize()`

* Use clearer language when checking scope types

* Include dashboard permissions in test to ensure they're ignored

* Switch to errutil

* Cleanup sql.Cfg refs

pkg/services/annotations/annotationsimpl/annotations.go

@@ -3,6 +3,8 @@ package annotationsimpl
 import (
 	"context"
 
+	"github.com/grafana/grafana/pkg/services/annotations/accesscontrol"
+
 	"github.com/grafana/grafana/pkg/infra/db"
 	"github.com/grafana/grafana/pkg/infra/log"
 	"github.com/grafana/grafana/pkg/services/annotations"
@@ -12,19 +14,25 @@ import (
 )
 
 type RepositoryImpl struct {
-	store store
+	db       db.DB
+	authZ    *accesscontrol.AuthService
+	features featuremgmt.FeatureToggles
+	store    store
 }
 
-func ProvideService(db db.DB, cfg *setting.Cfg, features featuremgmt.FeatureToggles, tagService tag.Service) *RepositoryImpl {
+func ProvideService(
+	db db.DB,
+	cfg *setting.Cfg,
+	features featuremgmt.FeatureToggles,
+	tagService tag.Service,
+) *RepositoryImpl {
+	l := log.New("annotations")
+
 	return &RepositoryImpl{
-		store: &xormRepositoryImpl{
-			cfg:               cfg,
-			features:          features,
-			db:                db,
-			log:               log.New("annotations"),
-			tagService:        tagService,
-			maximumTagsLength: cfg.AnnotationMaximumTagsLength,
-		},
+		db:       db,
+		features: features,
+		authZ:    accesscontrol.NewAuthService(db, features),
+		store:    NewXormStore(cfg, l, db, tagService),
 	}
 }
 
@@ -43,7 +51,12 @@ func (r *RepositoryImpl) Update(ctx context.Context, item *annotations.Item) err
 }
 
 func (r *RepositoryImpl) Find(ctx context.Context, query *annotations.ItemQuery) ([]*annotations.ItemDTO, error) {
-	return r.store.Get(ctx, query)
+	resources, err := r.authZ.Authorize(ctx, query.OrgID, query.SignedInUser)
+	if err != nil {
+		return make([]*annotations.ItemDTO, 0), err
+	}
+
+	return r.store.Get(ctx, query, resources)
 }
 
 func (r *RepositoryImpl) Delete(ctx context.Context, params *annotations.DeleteParams) error {