RBAC: Default to plugins.app:access for plugin includes

[gamab]

What is this feature?

This PR sets the permission required to access a navlink (=include) that was previously protected by role: Viewer (or
with no role/action specified) with action: plugins.app:access. This will allow users with the None role to view navlinks when they have the plugins.app:access permission.

Why do we need this feature?

Because some includes don't need any permission aside from plugins.app:access. This permission is the bare minimum you need to access a plugin. It's sort of the RBAC equivalent to reqRole = "Viewer" we had previously.

Special notes for your reviewer:

I assume I'll need to update the documentation :)

[wbrowne]

Apologies - way out of the loop on this but is the "app" in reference to the plugin type IE app plugins? I just see that technically for the CloudWatch datasource now for example, this will be returned as part of the API. I assume this is expected? I could be the only one lacking insight, but is this anything the plugin maintainers should be aware of to avoid any potential confusion?

[gamab]

is the "app" in reference to the plugin type IE app plugins?

Yes it is.

I just see that technically for the CloudWatch datasource now for example, this will be returned as part of the API. I assume this is expected?

No it's not 😅

I thought Includes were restricted to app plugins 😮 But obviously now that I look at other tests, it seems that other kind of plugins can define their includes.