os-server-groups policy doesn't separate CRUD actions

[Matthew Edmonds]

nova.api.openstack.compute.server_groups.ServerGroupController uses the same policy check (os_compute_api:os-server-groups) for show, delete, index, and create, instead of separating these into separate checks (e.g. os_compute_api:os-server-groups:delete). This makes it impossible to customize policy such that some roles are allowed to do some but not all of these operations, E.g. show/index server groups but not create/delete them.

Found with Newton.

[Liyingjun (liyingjun)]

Seems it already done, part of generated policy file:
"os_compute_api:os-server-groups:discoverable": "@"
#
"os_compute_api:os-server-groups": "rule:admin_or_owner"
#
"os_compute_api:os-server-groups:create": "rule:os_compute_api:os-server-groups"
#
"os_compute_api:os-server-groups:delete": "rule:os_compute_api:os-server-groups"
#
"os_compute_api:os-server-groups:index": "rule:os_compute_api:os-server-groups"
#
"os_compute_api:os-server-groups:show": "rule:os_compute_api:os-server-groups"