Move the seed into exp_scenario and seed the permission groups (#457)

The seed roles were owned by exp_roles, but they describe the scenario, so
they now live in exp_scenario/seed.ts next to the permissions they grant.
Each seed role names the permission group its holders belong to, and the
five groups the legacy config defined (Admin, Trusted, Standard, Guest,
Restricted) are seeded through exp_groups along with one role mapping per
role. Mapping priorities follow how exp_roles ranks a player's highest
role, so Jail lands in Restricted regardless of other roles.

SeedRolesRequest becomes exp_scenario's SeedRequest behind a new
exp_scenario.seed permission, and the button moves to the scenario's web
plugin, which gets a web entrypoint for it. exp_roles no longer depends on
exp_scenario, and exp_scenario gains controller tests around the seed.

With groups seeded from the controller the legacy expcore.permission_groups
module and its config are removed, along with the Group rcon static.

exp_scenario/test/seed.test.js

@@ -0,0 +1,85 @@
+"use strict";
+const t = require("tap");
+const lib = require("@clusterio/lib");
+const { seedRoles, seedGroups, flattenSeedPermissions } = require("../dist/node/seed");
+
+// Importing this defines the permissions the seed grants
+require("../dist/node/permissions");
+
+t.test("seedRoles[] grant only defined permissions", t2 => {
+	for (const role of seedRoles) {
+		for (const permission of role.permissions) {
+			t2.ok(lib.permissions.has(permission), `${role.name} grants defined permission ${permission}`);
+		}
+	}
+	t2.end();
+});
+
+t.test("seedRoles[] are unique with one default and one admin", t2 => {
+	const names = seedRoles.map(role => role.name);
+	t2.strictSame(names.length, new Set(names).size, "names are unique");
+	t2.strictSame(seedRoles.filter(role => role.isDefault).length, 1, "one default role");
+	t2.strictSame(seedRoles.filter(role => role.isAdmin).length, 1, "one admin role");
+	t2.end();
+});
+
+t.test("seedRoles[] are placed in defined groups", t2 => {
+	const groupNames = new Set(seedGroups.map(group => group.name));
+	for (const role of seedRoles) {
+		if (role.group !== undefined) {
+			t2.ok(groupNames.has(role.group), `${role.name} is placed in defined group ${role.group}`);
+		}
+	}
+	t2.end();
+});
+
+t.test("seedGroups[] are unique", t2 => {
+	const names = seedGroups.map(group => group.name);
+	t2.strictSame(names.length, new Set(names).size, "names are unique");
+	for (const group of seedGroups) {
+		t2.strictSame(
+			group.inputActions.length,
+			new Set(group.inputActions).size,
+			`${group.name} lists each input action once`,
+		);
+	}
+	t2.end();
+});
+
+t.test("flattenSeedPermissions() inherits permissions from parent roles", t2 => {
+	const byName = new Map(seedRoles.map(role => [role.name, role]));
+	for (const role of seedRoles) {
+		if (role.parent === undefined) {
+			continue;
+		}
+
+		const parent = byName.get(role.parent);
+		t2.ok(parent, `${role.name} has parent ${role.parent}`);
+
+		const flattened = flattenSeedPermissions(role);
+		for (const permission of flattenSeedPermissions(parent)) {
+			t2.ok(flattened.has(permission), `${role.name} inherits ${permission}`);
+		}
+	}
+	t2.end();
+});
+
+t.test("flattenSeedPermissions() does not inherit permissions when parent is undefined", t2 => {
+	for (const role of seedRoles) {
+		if (role.parent !== undefined) {
+			continue;
+		}
+
+		const flattened = flattenSeedPermissions(role);
+		for (const permission of role.permissions) {
+			t2.ok(flattened.has(permission), `${role.name} contains ${permission}`);
+		}
+
+		t2.equal(
+			flattened.size,
+			role.permissions.length,
+			`${role.name} has no inherited permissions`,
+		);
+	}
+	t2.end();
+});