AuthZService: improve authz caching

[akshayutture-augment]

Test 2

---

Replicated from ai-code-review-evaluation/grafana-cursor#2

---

Note

Adds a cached-permission fast path and explicit denial cache to RBAC checks/lists, updates metrics, and refactors RBAC client creation to use authzlib with configurable cache.

• AuthZ RBAC service:
  • Caching:
    • Add permDenialCache with key userPermDenialCacheKey(...) to short-circuit known denials in Check.
    • Introduce getCachedIdentityPermissions and use it in Check and List to return on cache hit before DB calls.
    • Populate denial cache on non-allowed checks; maintain existing permCache/idCache behavior.
    • Update metrics.permissionCacheUsage and request counters to reflect cache hits/misses.
  • Refactors:
    • Remove pre-check cache lookups from getUserPermissions/getAnonymousPermissions (handled centrally via getCachedIdentityPermissions).
• Client setup (pkg/services/authz/rbac.go):
  • Replace newRBACClient with direct authzlib.NewClient usage.
  • In in-proc mode, use NoopCache; remote client uses local cache with TTLs; tracer wired via option.
• Tests:
  • Add coverage for cached allow, cache miss fallback, outdated cache fallback, and explicit deny cache in Check.
  • Add cache-based listing test; adjust existing tests to new caching flow.

^{Written by Cursor Bugbot for commit d9dc93c. Configure here.}

[akshayutture-augment]

cursor review

[cursor]

✅ Bugbot reviewed your changes and found no bugs!

---