refactor(dbauthz): add authz for system-level functions (#6513)

- Introduces rbac.ResourceSystem
- Grants system.* to system and provisionerd rbac subjects
- Updates dbauthz system queries where applicable
- coderd: Avoid index out of bounds in api.workspaceBuilds
- dbauthz: move GetUsersByIDs out of system, modify RBAC check to ResourceUser
- workspaceapps: Add test case for when owner of app is not found

coderd/rbac/object.go

@@ -159,6 +159,11 @@ var (
 	ResourceDebugInfo = Object{
 		Type: "debug_info",
 	}
+
+	// ResourceSystem is a pseudo-resource only used for system-level actions.
+	ResourceSystem = Object{
+		Type: "system",
+	}
 )
 
 // Object is used to create objects for authz checks when you have none in