Migrations don't clean up old permissions

[shaunco]

At some point, some permission canonicalization happened around eq true and eq false, and new permissions were added to the permissions table during a migration, so these (any many others) are all duplicated:

resin.device_tag.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_tag.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_tag.delete?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_tag.delete?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
...
resin.image__is_part_of__release.read?is_part_of__release/any(r:r/belongs_to__application/any(a:a/is_public and is_for__device_type/canAccess()))
resin.image__is_part_of__release.read?is_part_of__release/any(r:r/belongs_to__application/any(a:a/is_public eq true and is_for__device_type/canAccess()))

but old permissions were never cleaned up and user/device/app/etc permissions were not migrated.

1. I can't figure out from docs or code which is the current preferred format
2. Seems like a migration should migrate all permission assignments to the latest format and the drop the old ones

The current full list:

auth.create_token
auth.credentials_login
resin.actor.delete?id eq @__ACTOR_ID
resin.api_key.delete?is_of__actor eq @__ACTOR_ID
resin.api_key.read?is_of__actor eq @__ACTOR_ID
resin.api_key.update?is_of__actor eq @__ACTOR_ID
resin.application_config_variable.all
resin.application_config_variable.read?application/canAccess()
resin.application_environment_variable.all
resin.application_environment_variable.read?application/canAccess()
resin.application_tag.all
resin.application_tag.read?application/any(a:a/is_public and is_for__device_type/canAccess())
resin.application_tag.read?application/any(a:a/is_public eq true and is_for__device_type/canAccess())
resin.application_tag.read?application/canAccess()
resin.application_type.all
resin.application.all
resin.application.read?is_public and is_for__device_type/canAccess()
resin.application.read?is_public eq true and is_for__device_type/canAccess()
resin.application.read?owns__device/canAccess() or (is_public and is_for__device_type/any(dt:dt/describes__device/canAccess()))
resin.application.read?owns__device/canAccess() or (is_public eq true and is_for__device_type/any(dt:dt/describes__device/canAccess()))
resin.application.supervisor-proxy-write
resin.cpu_architecture.read
resin.device_config_variable.all
resin.device_config_variable.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_config_variable.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_config_variable.read?device/canAccess()
resin.device_config_variable.update?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_config_variable.update?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_environment_variable.all
resin.device_environment_variable.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_environment_variable.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_environment_variable.delete?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_environment_variable.delete?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_environment_variable.read?device/canAccess()
resin.device_environment_variable.update?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_environment_variable.update?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_family.read
resin.device_manufacturer.read
resin.device_service_environment_variable.all
resin.device_service_environment_variable.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen) and service/any(s:s/application/any(a:a/owns__device/any(d:d/actor eq @__ACTOR_ID) or (a/is_public and a/owns__release/any(r:r/should_manage__device/any(d:d/actor eq @__ACTOR_ID) or r/should_operate__device/any(d:d/actor eq @__ACTOR_ID)))))
resin.device_service_environment_variable.create?service_install/any(si:si/device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false))
resin.device_service_environment_variable.delete?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_service_environment_variable.delete?service_install/any(si:si/device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false))
resin.device_service_environment_variable.read?device/canAccess()
resin.device_service_environment_variable.read?service_install/canAccess()
resin.device_service_environment_variable.update?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_service_environment_variable.update?service_install/any(si:si/device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false))
resin.device_tag.all
resin.device_tag.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_tag.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_tag.delete?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_tag.delete?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_tag.read?device/canAccess()
resin.device_tag.update?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.device_tag.update?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.device_type_alias.read
resin.device_type.read
resin.device_type.read?describes__device/canAccess()
resin.device.all
resin.device.cloudlink?actor eq @__ACTOR_ID
resin.device.create?belongs_to__application/any(a:a/actor eq @__ACTOR_ID)
resin.device.read
resin.device.read?actor eq @__ACTOR_ID and is_frozen eq false
resin.device.read?actor eq @__ACTOR_ID and not is_frozen
resin.device.supervisor-proxy-write
resin.device.supervisor-proxy-write?actor eq @__ACTOR_ID and not is_frozen
resin.device.tunnel-22222
resin.device.tunnel-48484
resin.device.update
resin.device.update?actor eq @__ACTOR_ID and is_frozen eq false
resin.device.update?actor eq @__ACTOR_ID and not is_frozen
resin.device.write-log?actor eq @__ACTOR_ID and is_frozen eq false
resin.device.write-log?actor eq @__ACTOR_ID and not is_frozen
resin.image__is_part_of__release.all
resin.image__is_part_of__release.read?is_part_of__release/any(r:r/belongs_to__application/any(a:a/is_public and is_for__device_type/canAccess()))
resin.image__is_part_of__release.read?is_part_of__release/any(r:r/belongs_to__application/any(a:a/is_public eq true and is_for__device_type/canAccess()))
resin.image__is_part_of__release.read?is_part_of__release/canAccess()
resin.image_environment_variable.all
resin.image_environment_variable.read?release_image/canAccess()
resin.image_install.all
resin.image_install.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false) and installs__image/any(i:i/image__is_part_of__release/any(ipr:ipr/is_part_of__release/any(r:r/belongs_to__application/any(a:a/owns__device/any(d:d/actor eq @__ACTOR_ID) or a/is_public eq true))))
resin.image_install.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen) and installs__image/any(i:i/image__is_part_of__release/any(ipr:ipr/is_part_of__release/any(r:r/belongs_to__application/any(a:a/owns__device/any(d:d/actor eq @__ACTOR_ID) or a/is_public))))
resin.image_install.read?device/canAccess()
resin.image_install.update?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.image_install.update?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.image_label.all
resin.image_label.read?release_image/canAccess()
resin.image.all
resin.image.read?image_install/canAccess() or image__is_part_of__release/canAccess()
resin.image.read?is_a_build_of__service/any(s:s/application/any(a:a/is_public and is_for__device_type/canAccess()))
resin.image.read?is_a_build_of__service/any(s:s/application/any(a:a/is_public eq true and is_for__device_type/canAccess()))
resin.organization_membership.read
resin.organization.read
resin.release_asset.all
resin.release_tag.all
resin.release_tag.read?release/any(r:r/belongs_to__application/any(a:a/is_public and is_for__device_type/canAccess()))
resin.release_tag.read?release/any(r:r/belongs_to__application/any(a:a/is_public eq true and is_for__device_type/canAccess()))
resin.release_tag.read?release/canAccess()
resin.release.all
resin.release.read?belongs_to__application/any(a:a/is_public and is_for__device_type/canAccess())
resin.release.read?belongs_to__application/any(a:a/is_public eq true and is_for__device_type/canAccess())
resin.release.read?is_pinned_to__device/canAccess() or belongs_to__application/canAccess()
resin.release.read?should_be_running_on__device/canAccess() or belongs_to__application/canAccess()
resin.service_environment_variable.all
resin.service_environment_variable.read?service/canAccess()
resin.service_install.all
resin.service_install.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false) and installs__service/any(s:s/application/any(a:a/owns__device/any(d:d/actor eq @__ACTOR_ID) or (a/is_public eq true and a/owns__release/any(r:r/should_manage__device/any(d:d/actor eq @__ACTOR_ID) or r/should_operate__device/any(d:d/actor eq @__ACTOR_ID)))))
resin.service_install.create?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false) and installs__service/any(s:s/application/any(a:a/owns__device/any(d:d/actor eq @__ACTOR_ID) or (a/is_public eq true and a/owns__release/any(r:r/should_manage__device/any(d:d/actor eq @__ACTOR_ID)))))
resin.service_install.create?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen) and installs__service/any(s:s/application/any(a:a/owns__device/any(d:d/actor eq @__ACTOR_ID) or (a/is_public and a/owns__release/any(r:r/should_manage__device/any(d:d/actor eq @__ACTOR_ID) or r/should_operate__device/any(d:d/actor eq @__ACTOR_ID)))))
resin.service_install.delete?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.service_install.delete?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.service_install.read?device/canAccess()
resin.service_install.update?device/any(d:d/actor eq @__ACTOR_ID and d/is_frozen eq false)
resin.service_install.update?device/any(d:d/actor eq @__ACTOR_ID and not d/is_frozen)
resin.service_instance.create
resin.service_instance.read?service_type eq 'vpn'
resin.service_instance.update
resin.service_label.all
resin.service_label.read?service/canAccess()
resin.service.all
resin.service.read?application/any(a:a/is_public and is_for__device_type/canAccess())
resin.service.read?application/any(a:a/is_public eq true and is_for__device_type/canAccess())
resin.service.read?application/canAccess() or is_built_by__image/canAccess()
resin.service.read?application/canAccess() or service_install/canAccess()
resin.user__has__public_key.all?user/any(u:u/actor eq @__ACTOR_ID)
resin.user__has__public_key.read
resin.user.create-named-user-api-key?actor eq @__ACTOR_ID
resin.user.create-user-api-key?actor eq @__ACTOR_ID
resin.user.read
service
service.api
service.vpn