fix: Refactor permissions

[nayeemrmn]

Fix granular permission requests/revokes. Properly model the "denied" state.

Fixes #7049.

Internal structure before:

pub struct Permissions {
  pub allow_read: PermissionState,
  pub read_allowlist: HashSet<PathBuf>,
  pub allow_write: PermissionState,
  pub write_allowlist: HashSet<PathBuf>,
  pub allow_net: PermissionState,
  pub net_allowlist: HashSet<String>,
  pub allow_env: PermissionState,
  pub allow_run: PermissionState,
  pub allow_plugin: PermissionState,
  pub allow_hrtime: PermissionState,
}

Internal structure after:

pub struct UnaryPermission<T: Eq + Hash> {
  global_state: PermissionState,
  granted_list: HashSet<T>,
  denied_list: HashSet<T>,
}

pub struct Permissions {
  pub read: UnaryPermission<PathBuf>,
  pub write: UnaryPermission<PathBuf>,
  pub net: UnaryPermission<String>,
  pub env: PermissionState,
  pub run: PermissionState,
  pub plugin: PermissionState,
  pub hrtime: PermissionState,
}

See docs/runtime/permission_apis.md for the corrected user-facing semantics.

[ry]

@nayeemrmn Nice. I think this looks ok. I don't see the test case presented in #7049 here - or did I miss it? It would be good to capture that.

[nayeemrmn]

@ry Ready for review 😩

[ry]

LGTM - thank you @nayeemrmn very nice refactor