swarming: switch to a 'capability focused' ACL system

appengine/swarming/server/task_scheduler.py

Index: appengine/swarming/server/task_scheduler.py
diff --git a/appengine/swarming/server/task_scheduler.py b/appengine/swarming/server/task_scheduler.py
index 5da8fdcbc0a4a327fbb138bbed44f93d0662320a..d9fbf5fdf493f07de0b32f063c358c3972aa6736 100644
--- a/appengine/swarming/server/task_scheduler.py
+++ b/appengine/swarming/server/task_scheduler.py
@@ -403,7 +403,8 @@ def _check_dimension_acls(request):
   # 'pool' is used as well (so whoever can posts tasks to 'pool', can target an
   # individual bot in that pool).
   if 'id' in dims and 'pool' not in dims:
-    if not acl.is_admin():
+    # Only super-users can create a task without 'id' nor 'pool'.
+    if not acl.can_edit_config():

[M-A Ruel, 2017/07/24 15:42:51]

This one is a bit awkward, not sure how to change.

[Vadim Sh., 2017/07/24 19:16:47]

Let's remove this clause. I think we have never used this feature and it was
pointed at as a potential security concern during the review.

So it should be:

if 'id' in dims and 'pool' not in dims:
  raise auth.AuthorizationError(
      'Posting a task with "id" dimension require specifying "pool" dimension')

Strictly speaking we can also try to lookup the dimensions of the bot and check
that the caller is allowed to use at least one pool dimensions specified there.
But it is more code.

[M-A Ruel, 2017/07/25 13:46:38]

All removed.

       raise auth.AuthorizationError(
           'Only Swarming administrators can post tasks with "id" dimension '
           'without specifying a "pool" dimension.')