fine grain access rule for documents, organizations and workspaces

[fflorent]

Something we would love to have is the ability to grant access to users according to ACL like it exists for documents, but at the level of the workspaces and organizations.

This way, we could restrict access to users who have some properties set to some values (like user.custom.is_external == false (where is_external could be fetched from the identity provider)

Related: #752 and #375

[paulfitz]

I've sometimes thought it would be cool if there were an optional site-level Grist document which, if present, were used to calculate access. Some mechanism for caching outcomes in the home db would be needed though, to keep certain important actions snappy (like the listing of available workspaces/docs you see when you visit a site).