Remove `any` from `PermissionController` types

[rekmarks]

Following #4171, any is only used in a small number of PermissionController types. They are mostly, but not always used as constraints. We should eliminate any from the following types:

• [ ] CaveatSpecificationBase
• [ ] PermissionSpecificationBase
• [ ] RestrictedMethodSpecificationConstraint
  • Will be resolved by #4238

For the *SpecificationBase types, I believe the solution is to genericize them such that TypeScript can determine whether a concrete specification is valid. The refactor necessary to accomplish this may not be terrible, but it's not trivial.