feat(iam): add dynamic ${user.email} resolution and case-insensitive userEmail matching across IAM evaluators

[coltondick]

I opened an issue a couple weeks back raising an problem with the limited flexibility of the IAM policies. I found it's limited scope to be quite tedious having to create a single user policy per use. I had initially assumed the ${user.email} would work just making assumptions from the documentation. However, I was surprised to find out that this didn't work. Adding support for ${user.email} reduces role duplication and makes for an overall better experience.

Previously you had to define the policy as follows and then replicate it per user:

[
  {
    "action": [
      "read",
      "search"
    ],
    "subject": "archive",
    "conditions": {
      "userEmail": "[email protected]"
    }
  },
  {
    "action": [
      "read",
      "search"
    ],
    "subject": [
      "dashboard",
      "ingestion"
    ]
  }
]

Now we can define the policy as follows:

[
  {
    "action": [
      "read",
      "search"
    ],
    "subject": "archive",
    "conditions": {
      "userEmail": "${user.email}"
    }
  },
  {
    "action": [
      "read",
      "search"
    ],
    "subject": [
      "dashboard",
      "ingestion"
    ]
  }
]

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coltondick]

I have read the CLA Document and I hereby sign the CLA

[coltondick]

Any chance that this can be implemented in the next release @wayneshn