feat: add chat model config RBAC resource (#27957)

Add the `chat_model_config` RBAC resource, actions, and API key scopes.
This layer includes the scope migration and generated API types. Model
list queries apply token scopes, SQL authorization filters, and row
ACLs.

Write and default-management handlers keep deployment configuration
authorization until the next API layer replaces it.

Depends on #27956

_This pull request description was generated by Coder Agents._

coderd/database/queries/chatmodelconfigs.sql

@@ -26,6 +26,8 @@ LEFT JOIN
     ai_providers ap ON ap.id = cmc.ai_provider_id
 WHERE
     cmc.deleted = FALSE
+    -- Authorize Filter clause will be injected below in GetAuthorizedChatModelConfigs
+    -- @authorize_filter
 ORDER BY
     ap.type::text ASC,
     cmc.model ASC,
@@ -140,6 +142,20 @@ WHERE
 RETURNING
     *;
 
+-- name: UpdateChatModelConfigACLByID :one
+UPDATE
+    chat_model_configs
+SET
+    group_acl = @group_acl,
+    user_acl = @user_acl,
+    updated_by = sqlc.narg('updated_by')::uuid,
+    updated_at = NOW()
+WHERE
+    id = @id::uuid
+    AND deleted = FALSE
+RETURNING
+    *;
+
 -- name: UnsetDefaultChatModelConfigs :exec
 UPDATE
     chat_model_configs