retire individual grants in RT
in https://gitlab.torproject.org/tpo/tpa/team/-/issues/41496#note_2988546, @lavamind suggested we have a policy to only grant "groups" access and grant users access to those groups, to facilitate permissions management and auditing.
let's do that.