feat: scope allow_list to include resource_type (#19748)

This feature allows the `allow_list` in the scopes to specify the `type`

coderd/rbac/input.json

@@ -1,5 +1,5 @@
 {
-	"action": "never-match-action",
+	"action": "read",
 	"object": {
 		"id": "9046b041-58ed-47a3-9c3a-de302577875a",
 		"owner": "00000000-0000-0000-0000-000000000000",
@@ -40,7 +40,11 @@
 			],
 			"org": {},
 			"user": [],
-			"allow_list": ["*"]
+			"allow_list": [
+				{
+					"type": "workspace",
+					"id": "*"
+				}]
 		}
 	}
 }