Migrate existing applications to RBAC

TODO: Common patterns for taking an existing application (which may or may not have some grouping abstraction like a Workspace) and migrating it to use Kessel RBAC.

Try to avoid repeating content in designing permissions schema by focusing on migration cases.