DIG-1502: Opa implements user-specific authorizations

[daisieh]

Candigv2-authx will implement the lists for pending_users and user authorizations in vault. Assuming that those are already there, this PR does the following on the Opa side:

• Gets the user's specific program authorization lists from Vault, calculates which programs the user is authorized to view, and allows the user to read programs they are either team members of or are specifically authorized to view.
• Adds DELETE operations as separately-authorized paths. Users authorized to curate can also delete.
• Adds tests for all of this.

Initialization will also create the empty pending_users list if it doesn't already exist.

Also instead of using the running instance's CLIENT_ID, we should be able to check the one in the aud that we've picked up when registering a federated server.

BONUS: There is now a github action that runs pytest automatically.

[kcranston]

Couple of documentation notes:

• Can you update the permissions_engine/readme.md with the changes?
• Either add some text to the top-level readme that points to the other (or we could merge them and just have one in the root dir)
• documentation somewhere about what endpoints are available, and that many (most?) operation goes through the authz library, not OPA directly

[daisieh]

I updated and moved the readme. The endpoints are in ingest, as documented in the readme, not in authx.

[kcranston]

LGTM now, merging