CloudMigrations: Introduce RBAC role for migration assistant (#98588)

* CloudMigrations: delete unused code

* CloudMigrations: add access control and protect API + navtree with action

* CloudMigrations: register access control roles

* CloudMigrations: gate frontend based with access control

* CloudMigrations: fix api tests

* CloudMigrations: add docs on new actions and roles

* CloudMigrations: dont interpolate vars to make it more greppable

* CloudMigrations: run prettier

pkg/services/cloudmigration/accesscontrol.go

@@ -0,0 +1,31 @@
+package cloudmigration
+
+import "github.com/grafana/grafana/pkg/services/accesscontrol"
+
+const (
+	ActionMigrate = "migrationassistant:migrate"
+)
+
+var (
+	// MigrationAssistantAccess is used to protect the "Migrate to Grafana Cloud" page.
+	MigrationAssistantAccess = accesscontrol.EvalPermission(ActionMigrate)
+)
+
+func RegisterAccessControlRoles(service accesscontrol.Service) error {
+	migrator := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:migrationassistant:migrator",
+			DisplayName: "Organization resource migrator",
+			Description: "Migrate organization resources.",
+			Group:       "Migration Assistant",
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: ActionMigrate,
+				},
+			},
+		},
+		Grants: []string{string(accesscontrol.RoleGrafanaAdmin)},
+	}
+
+	return service.DeclareFixedRoles(migrator)
+}