Dynamic groups feature

[simonw]

If there's no special mechanism for matching JSON on actors we could instead have code that dynamically adds or removes the actor from a group based on their JSON, matched against something in config? Then you could configure the plugin like this:

plugins:
  datasette-acl:
    dynamic-groups:
      admin:
        is_admin: true

Now any time we're about to run a permission check on an actor we first confirm that they are a member or NOT a member of the admin group based on matching them against that rule.

We can use actor_matches_allow(actor, allow) for that: https://github.com/simonw/datasette/blob/dc288056b81a3635bdb02a6d0121887db2720e5e/datasette/utils/__init__.py#L1025C5-L1026C1

Originally posted by @simonw in #1 (comment)