Silo admin endpoints for user logout + listing tokens and sessions

[david-crespo]

The idea here is that to disable a user's access to the system, admins first disable that user's ability to log in on the IdP side and then hit this endpoint to remove all of their existing credentials on our end. The centerpiece is the logout endpoint, but I added the endpoints for listing sessions and tokens because someone pointed out you really want to see those come back empty after logout. They're also kind of useful anyway. Then I added user_view just because it wouldn't make sense to have token and session list endpoints hanging off /v1/users/{user_id} without having that defined.

• Add /v1/users/{user_id}/logout that deletes all of the user's tokens and sessions
• Add new authz resource SiloUserAuthnList letting us authorize that action for silo admins specifically (can't use silo modify because fleet collaborator and admin get that on all silos)
• Update IAM policy test
• Test that logout deletes tokens and the right perms are enforced
• Test that logout deletes sessions and the right perms are enforced
• Add user_view and user_token_list and user_session_list endpoints for symmetry and to give the admin a warm fuzzy feeling when they see that the tokens and sessions are in fact gone (also makes testing a little cleaner)
• Fix session list including expired sessions (and test it)
• Think about whether we need to do something about dueling admins issues, i.e., what if the person you're trying to disable are themselves a silo admin and they log everyone else out of the silo. The only solution I can think of off the top of my head is an operator-level version of this endpoint that can be used by a user outside of the silo in question.

[david-crespo]

This is a little funny because I'm using list_children to determine whether you can list sessions and tokens (only self and silo admin can) but then I'm using modify on the list itself to determine whether you can do the logout delete-all operation. It works fine, but it goes slightly against the grain of how I know it's supposed to work. We just don't have many delete all type things.