RBAC: Clean up action set code (#88147)

* remove unused action set code, refactor the existing code

* fix import ordering

* use a separate interface for permission expansion after all, to avoid circular dependencies

* add comments, fix a test

pkg/services/accesscontrol/api/api_test.go

@@ -113,7 +113,11 @@ func TestAPI_getUserPermissions(t *testing.T) {
 				var output util.DynMap
 				err := json.NewDecoder(res.Body).Decode(&output)
 				require.NoError(t, err)
-				require.Equal(t, tt.expectedOutput, output)
+				for k, v := range output {
+					scopes, ok := tt.expectedOutput[k]
+					require.True(t, ok)
+					require.ElementsMatch(t, scopes, v)
+				}
 			}
 		})
 	}