Extend allow logic hierarchy & subscription manager to include 'authorization administrator' role (Managed Allow List)

[arjunhassard]

Creation of AuthAdmin role to sit in between the CohortAdmin (partner) and Encryptor (data producer) in the hierarchy of power. In most cases, AuthAdmin is an adopting developer of a joint SDK/offering between TACo & the partner. The AuthAdmin role is templated with a default configuration to make it easier for partners to understand, implement and parametrize the constraints of AuthAdmin/Encryptor behavior and onboarding.

Four-tier hierarchy of roles, where:

• Partner = CohortAdmin. This role controls the DKG public key can add or remove AuthAdmin based on arbitrary logic defined in its own contract(s).
• Developers adopting the joint partner + TACo SDK = AuthAdmin. This role can add or remove Encryptors to the allow list based on arbitrary logic defined in their own contract(s).
• End-users (data producers) = Encryptors.
• End-users (data consumers) are Requestors.

Allow logic contract flow:

1. Allow logic contract verifies that the Partner has a valid subscription in place.
2. Allow logic contract calls a Partner-defined contract to see if a given AuthAdmin is currently approved.
3. Allow logic does whatever logic is codified (e.g. checking a simple allow list for certain Encryptor addresses).

Impact on fee model, and consequences if CohortAdmin fails to pay/top-up to be detailed in separate issue.

Improvements:

• Safety features similar to Cohort parametrization safety features  ferveo#142
• Low-resistance path for AuthAdmins to become CohortAdmins and remove intermediary risk

See #255