Query allows actions on objects

Allows for querying of what actions a user can perform; results may be cached for a short period of time.

Each action names the resource it is queried against with a Spyderbat Resource Name (SRN) in 'resource_name'. An SRN has five colon-separated fields:

srn:<service>:<region>:<org>:<resource>

A field left empty matches broadly for that dimension. To query an org-scoped action without targeting a specific org — for example a global "load expired orgs" check — use the org-less SRN 'srn:org:::' rather than an empty string. A malformed 'resource_name' cannot be evaluated and is rejected with a 400 rather than reported as a denied ('can_perform: false') result.

An unrecognized 'action' does not fail the request: that entry is returned with 'can_perform' false and an 'error' set, so a caller probing a mix of actions still gets answers for the valid ones.