adjust UI to consider and disable/grey-out non applicable permissions on resources by type

[fmigneault]

relates to #499

For example:

The GetCapabilities does not apply to anything else than the service itself. Trying to set it on any underlying resource will yield an error on save. Using the service definition, it should be possible to pre-filter the permissions to gray-out the col/row combinations that cannot be applied.

Similarly, the Execute can only be applied for a Process resource (not Workspace or Layer).
However, Execute can still be applied on the service instead of the resource to allow it recursively on all nested Process resources.

The UI implementation should not try to resolve itself the valid combinations. The API should return the applicable permissions, and the UI would simply gray-out/disable the combobox selectors when not applicable. The API should already return this information (or at least it should be closely available) since the permission creation is already checked for valid cases and raises the error otherwise.