Merge permissions/grants invariant configs into their base configs

The invariant configs had separate base and *_with_permissions/*_with_grants
variants that differed only by an appended permissions or grants block.
Fold the block into the base config and drop the variant for jobs, database
instances, model serving endpoints, schemas, and secret scopes.

model is left as a separate model/model_with_permissions pair: continue_293
deploys first with CLI v0.293.0, which cannot deploy model permissions (see
its no_model_with_permissions exclude, PR #4941). Merging permissions into
model.yml.tmpl would force excluding it from continue_293 and lose base-model
continue-from-0.293.0 coverage. The other five resources have no such
old-version limitation.

Co-authored-by: Isaac

Author: denik

acceptance/bundle/invariant/configs/database_instance.yml.tmpl

@@ -6,3 +6,6 @@ resources:
     foo:
       name: test-db-instance-$UNIQUE_NAME
       capacity: CU_1
+      permissions:
+        - level: CAN_USE
+          group_name: users

acceptance/bundle/invariant/configs/database_instance_with_permissions.yml.tmpl

@@ -5,3 +5,6 @@ resources:
   jobs:
     foo:
       name: test-job-$UNIQUE_NAME
+      permissions:
+        - level: CAN_VIEW
+          group_name: users

acceptance/bundle/invariant/configs/job.yml.tmpl

@@ -5,3 +5,6 @@ resources:
   model_serving_endpoints:
     foo:
       name: test-endpoint-$UNIQUE_NAME
+      permissions:
+        - level: CAN_VIEW
+          group_name: users

acceptance/bundle/invariant/configs/job_with_permissions.yml.tmpl

@@ -6,3 +6,7 @@ resources:
     foo:
       catalog_name: main
       name: test-schema-$UNIQUE_NAME
+      grants:
+        - principal: account users
+          privileges:
+            - USE_SCHEMA

acceptance/bundle/invariant/configs/model_serving_endpoint.yml.tmpl

@@ -6,3 +6,8 @@ resources:
     foo:
       name: test-scope-$UNIQUE_NAME
       backend_type: DATABRICKS
+      permissions:
+        - level: READ
+          group_name: users
+        - level: WRITE
+          group_name: admins