authz: protect VPC Subnet endpoints

[davepacheco]

This is a work-in-progress but I'm hopeful that it's pretty close:

• test oxapi_demo
• update failing tests
• verify that my update to the "unauthorized" test correctly fails prior to my changes

This was a little trickier than some of the other ones for a few reasons:

• It's the first level of hierarchy below Projects that's not a leaf. I made a kind of cheesy generalization to authz::ProjectChild to make this work. I have some thoughts on making this more type-safe but I'd like to defer that for now because it'll affect many of the resources in that file.
• There's a saga using some of these functions so I had to update it to use the saga facility for serializing creds

@bnaecker I didn't realize until I got pretty far into this that this will likely conflict with #713. I don't think the conflict will be too bad in either direction but it'll involve a bunch of manual fix-up. I'll take another look at #713 before trying to land this.

[bnaecker]

Looks great, thanks for this!