Populate permission cache only for one DB at a time

[noahmoss]

Splits up the permissions cache so that we fetch it on-demand only for a single DB at a time. I've converted it from a delay to an atom that contains both the cached perms, and a set of db-ids which we've already fetched.

Partially addresses https://github.com/metabase/metabase/issues/47276 but I am also looking into excluding deactivated tables from the perms cache. It causes some unexpected test failures so it might be a little harder than anticipated.