Should be able to update the rbac middleware to do the following when the phase 1 feature flag is on:

• Call LookupResources on workspaces for the given (resource type scoped) permission
• If there are no results: return unauthorized
  • This is analogous to not having the permission in v1
• If there are results including the default workspace: return authorized with an empty rbac filter
  • This is analogous to having the permission without a resource filter in v1
• Otherwise: return authorized with an rbac filter of the given workspaces
  • This is analogous to having the permission with a resource filter in v1

This should result in the same behavior as v1.