Grant-based role end-to-end tutorial

[jamiewhths]

• Getting roles
• Creating a role (with parameters, database-level permissions, resource grants + optional resource grants)
• Assigning a user to the new role (with the parameter value assignment + optional resource grant assignment)
• Getting users/user role assignment
• Bulk user assignment (adding multiple users/updating role assignments/deactivating users/removing users)

[nickdickinson]

Add helper:

• getDatabaseRoles(databaseId)

[nickdickinson]

Remaining to be added to the tutorial:

• Bulk user assignment

[jamiewhths]

For bulk user assignment, take the same "small example" approach as Eliza's R examples, but with the following scenarios:

• Adding multiple users with the same role assignment, maybe with the parameter value different for each user (e.g. everyone is Data Entry role but with different reporting partners)
• Updating role assignments (when users were previously added, moving a batch of those users to a new role assignment) (maybe keeping the parameter values that were previously assigned -- e.g. move a group of Data Entry users with reporting partners to Supervisor roles with the same reporting partner)
• Deactivating users: to "deactivate" a user means to remove access to any database resources, while keeping them on the invited database users list. This is important for record auditing to maintain the user name/email, but we exclude users who have no grants on a database from billing evaluation on database. To "deactivate", create role with no grants and assign to user.
• Removing users: removing the user from the list of invited database users (this fully removes them from the database)