Feature request

Opening this ticket for feedback on the approach before starting implementation

Feature description

Improve the generate_policy verb to ensure service permissions for request are accounted for.

Context:

As mentioned in #91 (review) , policy files that auto generated by the generate_policy verb do not provision sufficient permissions for services, and instead only provision reply permissions when determined necessary via quiring the ros2 graph API.

Problems it will solve:

• Startime failures: nodes may otherwise crash at runtime when failing to initialize a client due to insufficient privileges.
• Runtime failures: nodes may also fail when remote servers refuse to accept requests from initialized client interfaces

Implementation considerations

This derives from the fact that the present ros2 graph API does not provide an interface to query for what services a node is assuming the client role. Although expanding the ros2 graph API could resolve this absence of information, in general a larger issue remains in that client interfaces may be temporally created, and thus harder to observe via a singular snapshot observation of the graph's current state. Alternate methods for modeling access control policies, such as inferring requirements from log event files like in AppArmor, could prove more complete in generating sufficient permissions for a target application.

Any feedback on the approach will be very appreciated :)