LU-18581 sec: add hsm_ops rbac role

LU-18581 sec: add hsm_ops rbac role

The purpose of the new hsm_ops rbac role is to control whether
clients can carry out HSM actions. When set, clients can call any
HSM primitive. When not set, clients get -EACCES when they try one of
the following:
- archive
- restore
- remove
- release
- set
- clear
- ct_register
- ct_unregister

sanity-hsm test_411 is added to exercise the new hsm_ops rbac role.

Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I234f4e8e37ec359ac9f790e29bf0b91725f2ef16
Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/57526
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Marc Vef <mvef@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>