mon: MonCap: add new profiles

Adds three new profiles:

read-only: able to issue all read-only (MON_CAP_R) commands. Any
command that may take additional caps (MON_CAP_W or MON_CAP_X) won't
be allowed.

read-write: able to issue all read-write (MON_CAP_R | MON_CAP_W)
commands. Commands that require MON_CAP_X will not be allowed.

role-definer: solely able to issue commands on the 'auth' subsystem,
to which all caps are given (MON_CAP_R | MON_CAP_W | MON_CAP_X).

Other patches in this series also have the AuthMonitor checking caps validity
before adding them to the keyring (seriously, we weren't doing this before)
and adds tests for the new roles on cephtool's test.sh.

Fixes: #8899

Signed-off-by: Joao Eduardo Luis ``joao.luis@inktank.com``