chore: refactor roles to support multiple permission sets scoped by org id (#20186)

In preparation for adding the "member" permission level, which will also
be grouped by org ID, do a bit of a refactor to make room for it and the
existing "org" level to live in the same `map`

coderd/database/modelmethods.go

@@ -176,8 +176,8 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 		// Identifier is informational; not used in policy evaluation.
 		Identifier: rbac.RoleIdentifier{Name: "Scope_Multiple"},
 		Site:       nil,
-		Org:        map[string][]rbac.Permission{},
 		User:       nil,
+		ByOrgID:    map[string]rbac.OrgPermissions{},
 	}
 
 	// Collect allow lists for a union after expanding all scopes.
@@ -191,8 +191,10 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 
 		// Merge role permissions: union by simple concatenation.
 		merged.Site = append(merged.Site, expanded.Site...)
-		for orgID, perms := range expanded.Org {
-			merged.Org[orgID] = append(merged.Org[orgID], perms...)
+		for orgID, perms := range expanded.ByOrgID {
+			orgPerms := merged.ByOrgID[orgID]
+			orgPerms.Org = append(orgPerms.Org, perms.Org...)
+			merged.ByOrgID[orgID] = orgPerms
 		}
 		merged.User = append(merged.User, expanded.User...)
 
@@ -201,10 +203,11 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 
 	// De-duplicate permissions across Site/Org/User
 	merged.Site = rbac.DeduplicatePermissions(merged.Site)
-	for orgID, perms := range merged.Org {
-		merged.Org[orgID] = rbac.DeduplicatePermissions(perms)
-	}
 	merged.User = rbac.DeduplicatePermissions(merged.User)
+	for orgID, perms := range merged.ByOrgID {
+		perms.Org = rbac.DeduplicatePermissions(perms.Org)
+		merged.ByOrgID[orgID] = perms
+	}
 
 	union, err := rbac.UnionAllowLists(allowLists...)
 	if err != nil {