internal/perms: Fix grant parser bugs (#3660)

* internal/perms: Fix grant parser bugs

This fixes two bugs in the grant parser:

1. The parser would accept "," as an output field when parsing from JSON.
  This would then make it into the canonical string,
  which would make it look like we had a trailing comma.
  Disallow the use of a comma as an output field.
2. The parser would accept empty IDs when parsing from JSON.
  Make this behavior consistent with the text behavior.

* internal/perms: also handle empty IDs in text form

* internal/perms: disallow any commas

Commas anywhere in ids or output fields corrupt
the canonical output string.

* internal/perms: disallow any reserved characters

id, ids and actions could all contain one of the
reserved characters ",", "=" or ";" when used with
JSON.

internal/perms/testdata/fuzz/FuzzParse/3187a710d9bc1612

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("ids=,;actions=reAd")

internal/perms/testdata/fuzz/FuzzParse/4572b81e0281070d

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("{\"output_fields\":[\",\"]}")

internal/perms/testdata/fuzz/FuzzParse/536fbfc4db40b83d

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("{\"id\":\"=\",\"actions\":[\"reAd\"]}")

internal/perms/testdata/fuzz/FuzzParse/5d676d09fce49675

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("{\"ids\":[\",00\"],\"actions\":[\"CreAte\"]}")

internal/perms/testdata/fuzz/FuzzParse/6bfe75c429073a6a

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("id=,;output_fields=0")

internal/perms/testdata/fuzz/FuzzParse/9b33c3b84320755d

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("id=,0;output_fields=0")

internal/perms/testdata/fuzz/FuzzParse/c9a7351b4994e353

@@ -0,0 +1,2 @@
+go test fuzz v1
+string("{\"ids\":[\"\"],\"actions\":[\"CreAte\"]}")