chore: refactor roles to support multiple permission sets scoped by org id (#20186)

In preparation for adding the "member" permission level, which will also
be grouped by org ID, do a bit of a refactor to make room for it and the
existing "org" level to live in the same `map`

coderd/rbac/scopes_test.go

@@ -34,7 +34,7 @@ func TestExpandScope(t *testing.T) {
 				require.Len(t, s.Site, 1)
 				require.Equal(t, tc.resource, s.Site[0].ResourceType)
 				require.Equal(t, tc.action, s.Site[0].Action)
-				require.Empty(t, s.Org)
+				require.Empty(t, s.ByOrgID)
 				require.Empty(t, s.User)
 
 				require.Equal(t, []rbac.AllowListElement{rbac.AllowListAll()}, s.AllowIDList)