Extended FHIR server user role config

[hhund]

• FHIR server roles (CREATE, READ, UPDATE, DELETE, SEARCH, HISTORY, PERMANENT_DELETE, WEBSOCKET) can now be specified for specific FHIR resources. For example: - CREATE: [Organization, OrganizationAffiliation, Endpoint] other examples see test setup docker-compose files.
• Roles SEARCH, HISTORY and WEBSOCKET require users to have the READ role as well, if the User has no READ role for a specific resource, SEARCH, HISTORY and WEBSOCKET operations will filter out the resource type.
• Removed identity parameter from ReferenceResolver methods. Implementation no longer uses identity filters when searching for resources in DB, user may not have role to search or read referenced resource but reference should be checked anyways. For example: Update role for QuestionnaireResponse but no search or read for Organization.
• Resource validator workaround for QuestionnaireResponse display text values.
• Minimized role config for remote organization identities: CREATE [Task], READ, SEARCH, HISTORY
• Some code cleanup.

closes #365

[wetret]

Can we extend this to include profiles for different resources? This would allow access to be granted to specific users only for selected processes.

An extension for specific FHIRPath expressions that evaluate certain values within those paths could even more improve the options for user access management. For example identifiers that start with a certain prefix.

[hhund]

@wetret Although possible, I would suggest to first improve the way Task and QuestionnaireResponse resources are associated with users and user roles, see #367