Team object, team membership

Implement Team.run_jobs

Add type info to member propagation jobs

Explicitly set member type

Remove STI for members

Expect member key

Test membership filtering by Team and CloudUser

Make remove_members work the same as add_members, default members to user members

Make role_for work with teams

Handle type being nil in the datastore for user members

Add test to distinguish type in member operations

Typo

Move pending op

Propagate team changes, expand team members into domain and apps

Add team propagation tests

Initial work to propagate grants

Use mongoid methods

Stop tracking grants

Add test for has_membership_changes? when changing grants without changing calculated roles

Make pending op args more backwards compatible

Update pending op args

Add back role_changed? to has_member_changes? check

Clone submembers when expanding teams, don't propagate teams from domains to applications

Don't propagate teams from domains to apps

Test propagation on team destroy

Ensure we remove team grants from all members when removing a team

Make app member change op work correctly with new pending_op param format

Add escalation/de-escalation tests, fix issue demoting roles from an existing source

Test merging duplicate grant sources

Make teams unique per owner

Make teams accessible if they are a peer member of a domain

Index members by id and type

Change default role on teams to :view
Code review comments
Handle duplicate removes, removal of non-members
Test explicit/implicit role interaction
Validate roles
Improve finding a member in a members collection