Team object, team membership

Implement Team.run_jobs

Add type info to member propagation jobs

Explicitly set member type

Remove STI for members

Expect member key

Test membership filtering by Team and CloudUser

Make remove_members work the same as add_members, default members to user members

Make role_for work with teams

Handle type being nil in the datastore for user members

Add test to distinguish type in member operations

Typo

Move pending op

Propagate team changes, expand team members into domain and apps

Add team propagation tests

Initial work to propagate grants

Use mongoid methods

Stop tracking grants

Add test for has_membership_changes? when changing grants without changing calculated roles

Make pending op args more backwards compatible

Update pending op args

Add back role_changed? to has_member_changes? check

Clone submembers when expanding teams, don't propagate teams from domains to applications

Don't propagate teams from domains to apps

Test propagation on team destroy

Ensure we remove team grants from all members when removing a team
Make app member change op work correctly with new pending_op param format
Add escalation/de-escalation tests, fix issue demoting roles from an existing source
Test merging duplicate grant sources
Make teams unique per owner
Make teams accessible if they are a peer member of a domain
Index members by id and type
Change default role on teams to :view