Support access: security policies on Explore and Canvas resources

[begelundmuller]

This PR adds support for access: security policies on canvas and explore resources. Among other use cases, this enables hiding dashboards that will anyway fail to render for people who don't have access to the underlying metrics views.

A policy on an explore/canvas resource does not prevent direct queries to the underlying metrics views, so it is still recommended to define security policies directly on metrics views.

Changes:

• Adds support for access: security rules on resources of type: explore and type: canvas.
• Retains the current behavior of additionally inheriting the parent metrics view's security rules for explore resources.

Examples:

# explores/my_explore.yaml
type: explore
title: My Explore
metrics_view: my_metrics
security:
  access: "{{ .user.admin }}"

# canvases/my_explore.yaml
type: canvas
title: My canvas
security:
  access: "{{ .user.admin }}"

Closes #5500.