feat(query): Create queries for recursive requests of global app token grants

[dkanney]

• ICU-17909
• ICU-17910
• ICU-17916

Description

Retrieves grants for App Tokens that live in the Global scope. Queries will be selected based on the scope(s) the requested Resources can live at:

• Resources that can live in any scope (e.g. Groups)
• Resources that can only live in either Global or an Org scope (e.g. Policies, Storage Buckets)
• Resources that can only live in a Project scope (e.g. Hosts, Targets)

Since these queries correspond to recursive requests, there is no request_scope to query on.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.
  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[mikemountain]

can we get this moved to an apptoken level, instead of iam? thanks!