chore: break down dbauthz.System into smaller roles (#6218)

- rbac: export rbac.Permissions
- dbauthz: move GetDeploymentDAUs, GetTemplateDAUs,
  GetTemplateAverageBuildTime from querier.go to system.go
  and removes auth checks
- dbauthz: remove AsSystem(), add individual roles for
  autostart, provisionerd, add restricted system role for 
  everything else

coderd/metricscache/metricscache.go

@@ -144,7 +144,7 @@ func countUniqueUsers(rows []database.GetTemplateDAUsRow) int {
 
 func (c *Cache) refresh(ctx context.Context) error {
 	//nolint:gocritic // This is a system service.
-	ctx = dbauthz.AsSystem(ctx)
+	ctx = dbauthz.AsSystemRestricted(ctx)
 	err := c.database.DeleteOldAgentStats(ctx)
 	if err != nil {
 		return xerrors.Errorf("delete old stats: %w", err)