fix(cli): updates 'grants add' command

[kimskimchi]

Summary

1. updates grants add command to take in user rather than destination as the command argument.2.
2. redefines flags
   a) -ito be consistent with our term identity, as well as the identity command
   b) -ican be user, machine, or group. However, if it is a group, you must mark it manually as -g to override detecting the type (user or machine) automatically
   c) flag role is optional
   d) flag provider is situationally required: if more than two providers, and identity is a group or user, then it is required. (machines are local only, so no need to provide flag if identity is a machine)
   e) you can specify identity as a cmd argument OR flag. same behaviour as login's SERVER
   f) removes machine and user flags.
3. Gives extensive explanation on the flags. 4.
4. Fixes bug where where it wasn't asking for provider when there are multiple rpoviders5.
5. Marks flag destination as required, Marks identity value as required (either flag or cmd argument)6.
6. Role is optional. Use if you want control. Otherwise, it will default to connect. 7.
7. Adds panic in areas where it is a programming error state - eg, it should never arrive at that state.

Checklist:

• Wrote appropriate unit tests
• Considered security implications of the change
• Updated associated docs where necessary
• Updated associated configuration where necessary
• Change is backwards compatible if it needs to be (user can upgrade without manual steps?)
• Nothing sensitive logged
• Commit message conforms to Conventional Commit
• GitHub Actions are passing
• Considered data migrations for smooth upgrades

Related Issues

Resolves #1250
Resolves #1393
Resolves #1432

[jmorganca]

Let's remove the -g and -i flags and just look up 1/ identity and 2/ group by name and select the first one

[BruceMacD]

I'm not a fan of the ambiguity here, it opens up a lot of possibility for unexpected behavior.

If there is overlap between an identity name and group name you could accidentally grant or revoke access to the wrong subject.

[dnephin]

If we wanted them to be safely interchangeable we would probably need a unique constraint on the database to prevent adding an identity and a group with the same name.

[BruceMacD]

Looking really good, my main concern at the moment is the "group" identity type that opens up the door for adding groups into db tables where they shouldn't be.

[BruceMacD]

I'd like to see more examples with roles personally, not something that blocks this change though.

[kimskimchi]

role is optional, it will default to 'connect' so users who don't care about fine-grained roles have to specify them