refact(action): Make ActionSet behave as a set instead of a list

This switches the implementation of an ActionSet from a slice to a map
to ensure the elements in an ActionSet are unique. This allows for other
packages to perform set operations such as a union or difference without
needing to account for duplicates.

internal/daemon/controller/auth/auth.go

@@ -722,10 +722,10 @@ func (r *VerifyResults) fetchActions(id string, typ resource.Type, availableActi
 		res.Type = typ
 	}
 
-	ret := make(action.ActionSet, 0, len(availableActions))
-	for _, act := range availableActions {
+	ret := make(action.ActionSet, len(availableActions))
+	for act := range availableActions {
 		if r.v.acl.Allowed(*res, act, *r.UserData.User.Id).Authorized {
-			ret = append(ret, act)
+			ret.Add(act)
 		}
 	}
 	if len(ret) == 0 {
@@ -854,7 +854,7 @@ func (r *VerifyResults) ScopesAuthorizedForList(ctx context.Context, rootScopeId
 		scpId := scp.GetPublicId()
 		aSet := r.FetchActionSetForType(ctx,
 			resource.Unknown, // This is overridden by `WithResource` option.
-			action.ActionSet{action.List},
+			action.NewActionSet(action.List),
 			WithResource(&perms.Resource{Type: resourceType, ScopeId: scpId}),
 		)
 
@@ -867,7 +867,7 @@ func (r *VerifyResults) ScopesAuthorizedForList(ctx context.Context, rootScopeId
 			// lookup might fail.
 			deferredScopes = append(deferredScopes, scp)
 		case len(aSet) == 1 || r.UserId == globals.RecoveryUserId:
-			if aSet[0] != action.List {
+			if !aSet.HasAction(action.List) {
 				return nil, errors.New(ctx, errors.Internal, op, "unexpected action in set")
 			}
 			if scopeResourceMap[scpId] == nil {