Compute services (os-services) API not granular enough by policy and code

The Nova Compute services (os-services) API is not granular enough in the sense that multiple APIs check the same policy action for list, update, and delete. This does not allow operators with strict security requirements to have different roles that can perform certain APIs but not others - it currently is all or nothing. As it currently stands, listing, updating, and deleting compute services checks the single policy action 'os_compute_api:os-services' - which prevents operators who want read only roles or other sub-admin type roles. To further achieve RBAC granularity, new policy actions should be introduced and checked by the os-services API.