Decouple delete permissions from resource paths

[shwetamurali]

Description

Delete permissions now resolve correctly for resources with non-standard URL structures (explorer-saved-queries, run-tasks). Previously, ClassFromPath used a heuristic that extracted the second to last path segment, which failed when the segment didn't match the resource type name (e.g. /organizations/{org}/explorer/views/{id} returned "views" instead of "explorer-saved-queries").

Example Output

Authorized session: grant is explorer-saved-queries while the path is .../views/..., and it now matches:

$ tfctl api /api/v2/organizations/my-org/explorer/views/sq-abc -X DELETE
ERROR: refusing to DELETE ... no active session permission for resource class
"explorer-saved-queries".

PR Checklist

• Run npx changie new or install changie to prepare a new changelog entry for the next set of release notes.
• Ensure any command changes are sensitive to these global flags:
  • --json — Force machine readable output to stdout. Does not apply to stderr.
  • --markdown — Force markdown output to stdout. Does not apply to stderr.
  • --dry-run — Don't make any actual writes or other mutations. Describe what would have changed to stderr.
  • --quiet — Only render essential content.
• Get the logging interface from the context and add debug logging for interesting conditions and nonfatal situations.
• Run make gen/screenshot if the root command output changes.
• Add the Autocomplete field to positional arguments and flags to assist shell autocomplete.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[brandonc]

The new one is cut off for some reason