fix: update internal labels endpoints to work with RBAC

[joeyorlando]

What this PR does

Related to:

• https://github.com/grafana/oncall-private/issues/2943

Checklist

• Unit, integration, and e2e (if applicable) tests updated
• Documentation added (or pr:no public docs PR label added if not required)
• Added the relevant release notes label (see labels prefixed w/ release:). These labels dictate how your PR will
  show up in the autogenerated release notes.

[joeyorlando]

I'll finish renaming the hardcoded plugin IDs, to use PluginID, in a subsequent PR

[vadimkerr]

I only see the Labels Reader and Labels Writer roles in the existing Grafana RBAC UI, is this PR introducing a new one for create? maybe it's a good idea to only keep read and write (so create is part of write)?

[joeyorlando]

tldr; no it's not introducing any new RBAC roles. The LABEL_CREATE, LABEL_READ, and LABEL_WRITE variables are just helpers which translate to the permission strings grafana-labels-app:label:create, grafana-labels-app:label:read, and grafana-labels-app:label:write, respectively.

---

Those are the RBAC roles that're available from Labels. Roles grant >= 1 permission(s) . These are the permissions granted by those labels RBAC roles:

"roles": [
    {
      "role": {
        "name": "Labels Writer",
        "description": "Read/write/create/delete Labels",
        "permissions": [
          { "action": "plugins.app:access", "scope": "plugins:id:grafana-labels-app" },
          { "action": "grafana-labels-app.label:read" },
          { "action": "grafana-labels-app.label:write" },
          { "action": "grafana-labels-app.label:create" },
          { "action": "grafana-labels-app.label:delete" }
        ]
      },
      "grants": ["Admin", "Editor"]
    },
    {
      "role": {
        "name": "Labels Reader",
        "description": "Read-only access to Labels",
        "permissions": [
          { "action": "plugins.app:access", "scope": "plugins:id:grafana-labels-app" },
          { "action": "grafana-labels-app.label:read" }
        ]
      },
      "grants": ["Viewer"]
    }
  ]

so in OnCall we're basically validating that the user has the necessary permission (action), we don't necessarily care about the role names themselves.

I agree that :write and :create should be consolidated over in labels but that's the current state of things. If you're curious, see these resources for more context:

• https://github.com/grafana/gops-labels/blob/main/pkg/plugin/auth.go#L42
• https://github.com/grafana/gops-labels/blob/main/pkg/plugin/plugin.go#L70-L74
• https://github.com/grafana/gops-labels/blob/main/pkg/plugin/plugin.go#L84-L96