Re-assess policy read Casbin policy

[jakedoublev]

Related to #1559

Policy read is currently wide open to the standard role in Casbin policy which means any authenticated user:

platform/service/internal/auth/casbin.go

Lines 89 to 97 in 7dc0b91

	p, role:standard, policy.*, read, allow
	p, role:standard, kasregistry.*, read, allow
	p, role:standard, kas.AccessService/Rewrap, *, allow
	## HTTP routes
	p, role:standard, /attributes*, read, allow
	p, role:standard, /namespaces*, read, allow
	p, role:standard, /subject-mappings*, read, allow
	p, role:standard, /resource-mappings*, read, allow
	p, role:standard, /key-access-servers*, read, allow

As policy and the platform have matured, review and re-assess whether this is appropriate for the following policy objects, or if more or less privilege is required:

1. Subject Mappings
2. Subject Condition Sets
3. GetAttributesByValueFqns
4. KAS Grants (which are needed on encrypt and therefore must be widely available)
5. KAS Registry
6. Resource Mappings

Acceptance Criteria

1. read privileges are considered in light of the needs for various encrypt/decrypt flows
2. read privileges remain for admins and org-admins
3. defaultPolicy is updated if needed
4. decisioning around the above is documented in this issue