Query and Eventing need an RBAC based curl_allowedlist

Eventing Functions, (maybe Query UDFs) and Query need a curl_allowedlist (whitelist) which are "role" based

Right now in 7.0 for Query

We seem to only have a single set of global set of whitelist items in the main settings page of the couchbase-server UI under

• Settings / Query Settings / Advanced Query Settings
• If CURL() Function Access is set to Restricted then we can enter a list of URLs

Right now in 7.0 for Eventing 

• We allow users to enter cURL URLs in their Eventing functions to access external REST APIs
• In 7.1 we will have the ability to disable 'curl' calls from JavaScript globally

However the above functionality really will not work well for multi-tenant environments in the cloud (Capella).  We need to somehow create a curl_allowedlist associated with either a "Group" or a "User" in our RBAC system.

This curl_allowedlist should be an artifact tagged much like "Manage Scope Functions" under "Query & Index" in version 7.0 - or - "Manage Scope Functions" under "Eventing" in 7.1.   

In addition the ability to disable/enable 'curl' calls globally a more granular limitation should be supported via a checkbox in RBAC similar to "Execute Global External Functions" in Query & Index".  Alternatively without a curl_allowedlist assigned to a Function Scope (a bucket.scope tag) then cURL is disabled completely for any Eventing Function under that Function Scope.