Add limited collaborator role

[charliepark]

This PR adds a new role, of a "limited collaborator". The role essentially has restrictions on networking resources, as specified below.

Backstory: We had a request for limitations that could be applied to certain users, in https://github.com/oxidecomputer/customer-support/issues/416. We explored an alternate option (#9227), involving a new silo-level restrict_network_actions flag in the database, but the complexity of that solution suggested there could be a better approach. @davepacheco suggested exploring an exclusively role-based approach via Polar rules, which this PR realizes.

The limited collaborator role will not be able to create, modify, or delete (but will be able to read / list children of) the following resources:

• VPC
• Subnet
• Firewall Rule
• Custom Router
• Route
• Internet Gateway (including attach/detach IP pools and IP addresses)

Limited Collaborators will still be allowed full create / modify / delete permissions on these resources:

• Floating IP
• Instance Network Interfaces