dynamic host volumes: ACL policies

[tgross]

This changeset implements the ACLs required for dynamic host volumes RPCs:

• host-volume-register is the highest privilege because it potentially bypasses quotas.
• host-volume-create is implicitly granted by host-volume-register
• host-volume-read is implicitly granted by policy = "read", host-volume-register, and host-volume-create.

These are namespaced operations, so the testing here is predominantly around parsing and granting of implicit capabilities rather than the well-tested AllowNamespaceOperation method.

This changeset does not include any changes to the host_volumes policy which we'll need for claiming volumes on job submit (if any). That'll be covered in a later PR.

Ref: https://hashicorp.atlassian.net/browse/NET-11549