Updating policy for neutron and nova to include role: baremetaluser

[claudia-lola]

Updating policy to allow role: baremetaluser to map baremetal instances to specific ironic nodes (this is desirable so that the instance name = ironic node name, making debugging less confusing)

[gemini-code-assist]

Code Review

This pull request updates Neutron and Nova policies to grant the baremetaluser role additional permissions, aligning with the goal of simplifying baremetal instance management. The changes in the Nova policy file are clear and correct. For the Neutron policy file, I've suggested a minor improvement to enhance readability and prevent potential issues by explicitly grouping and conditions with parentheses. Overall, the changes look good and address the intended purpose.

[JohnGarbutt]

So first of all - it can't be the default.
Second of all - we don't have support for merging policy.yaml files together - so I would say before that lands - we need to work on the kolla-ansible side to add support for either policy.d (which would be ideal) - or merging policy.yaml files together and validating them?

But the alternative is users bricking the cloud using the admin role?

I didn't know the policy didn't merge. Given people have overrides that is a very good reason for this to not be the default. Supporting policy.d makes very good sense as something for the backlog.

Is a mix-in for now a better middle ground for now?