[server] FGA checks for all admin*Workspace methods

[geropl]

Description

Adds basic FGA checks for:

• adminGetWorkspaces
• adminGetWorkspace
• adminGetWorkspaceInstances
• adminForceStopWorkspace
• adminRestoreSoftDeletedWorkspace

To implement some of these, I added a permission workspace#admin_control to the schema (ref).

Summary generated by Copilot

🤖 Generated by Copilot at e87346d

This pull request adds a new admin_control permission for workspaces, which allows installation admins to perform administrative tasks on workspaces, such as restoring soft-deleted workspaces. The permission is implemented in the Spicedb schema, the WorkspacePermission type, and the gitpod-server-impl.ts methods.

Related Issue(s)

Fixes #

How to test

Documentation

Preview status

Gitpod was successfully deployed to your preview environment.

• 🏷️ Name - gpl-fga-admin-ws
• 🔗 URL - gpl-fga-admin-ws.preview.gitpod-dev.com/workspaces.
• 📚 Documentation - See our internal documentation for information on how to interact with your preview environment.
• 📦 Version - gpl-fga-admin-ws-gha.15786

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold

[geropl]

/unhold