refactor(authz): use a struct for user access control info operations (#1682)

fix(authz): fix isAdmin not using groups to determine if a user is admin.
fix(authz): return 401 instead of 403

403 is correct as per HTTP spec
However authz is not part of dist-spec and clients know only about 401
So this is a compromise.

Signed-off-by: Petu Eusebiu <peusebiu@cisco.com>

pkg/api/constants/consts.go

@@ -23,4 +23,12 @@ const (
 	APIKeysPrefix                = "zak_"
 	CallbackUIQueryParam         = "callback_ui"
 	APIKeyTimeFormat             = time.RFC3339
+	// authz permissions.
+	// method actions.
+	CreatePermission = "create"
+	ReadPermission   = "read"
+	UpdatePermission = "update"
+	DeletePermission = "delete"
+	// behaviour actions.
+	DetectManifestCollisionPermission = "detectManifestCollision"
 )