feat: Add initial AuthzQuerier implementation (#5919)

feat: Add initial AuthzQuerier implementation
- Adds package database/dbauthz that adds a database.Store implementation where each method goes through AuthZ checks
- Implements all database.Store methods on AuthzQuerier
- Updates and fixes unit tests where required
- Updates coderd initialization to use AuthzQuerier if codersdk.ExperimentAuthzQuerier is enabled

coderd/roles_test.go

@@ -30,7 +30,7 @@ func TestListRoles(t *testing.T) {
 	})
 	require.NoError(t, err, "create org")
 
-	const forbidden = "Forbidden"
+	const notFound = "Resource not found"
 	testCases := []struct {
 		Name            string
 		Client          *codersdk.Client
@@ -66,7 +66,7 @@ func TestListRoles(t *testing.T) {
 			APICall: func(ctx context.Context) ([]codersdk.AssignableRoles, error) {
 				return member.ListOrganizationRoles(ctx, otherOrg.ID)
 			},
-			AuthorizedError: forbidden,
+			AuthorizedError: notFound,
 		},
 		// Org admin
 		{
@@ -95,7 +95,7 @@ func TestListRoles(t *testing.T) {
 			APICall: func(ctx context.Context) ([]codersdk.AssignableRoles, error) {
 				return orgAdmin.ListOrganizationRoles(ctx, otherOrg.ID)
 			},
-			AuthorizedError: forbidden,
+			AuthorizedError: notFound,
 		},
 		// Admin
 		{
@@ -133,7 +133,7 @@ func TestListRoles(t *testing.T) {
 			if c.AuthorizedError != "" {
 				var apiErr *codersdk.Error
 				require.ErrorAs(t, err, &apiErr)
-				require.Equal(t, http.StatusForbidden, apiErr.StatusCode())
+				require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
 				require.Contains(t, apiErr.Message, c.AuthorizedError)
 			} else {
 				require.NoError(t, err)