Remove role based perms, fetch cosmetics.json from api (#1640)

## Description:

* Fetch cosmetics.json from api
* Remove all role based perms, we are only using flares now
* Created Priviledge refresher which periodically polls /cosmetics.json
endpoint.

## Please complete the following:

- [x] I have added screenshots for all UI updates
- [x] I process any text displayed to the user through translateText()
and I've added it to the en.json file
- [x] I have added relevant tests to the test directory
- [x] I confirm I have thoroughly tested these changes and take full
responsibility for any bugs introduced
- [x] I have read and accepted the CLA agreement (only required once).

## Please put your Discord username so you can be contacted if a bug or
regression is found:

evan

src/server/PrivilegeRefresher.ts

@@ -0,0 +1,68 @@
+import { base64url } from "jose";
+import { Logger } from "winston";
+import { CosmeticsSchema } from "../core/CosmeticSchemas";
+import {
+  FailOpenPrivilegeChecker,
+  PrivilegeChecker,
+  PrivilegeCheckerImpl,
+} from "./Privilege";
+
+// Refreshes the privilege checker every 5 minutes.
+// WARNING: This fails open if cosmetics.json is not available.
+export class PrivilegeRefresher {
+  private privilegeChecker: PrivilegeChecker | null = null;
+  private failOpenPrivilegeChecker: PrivilegeChecker =
+    new FailOpenPrivilegeChecker();
+
+  private log: Logger;
+
+  constructor(
+    private endpoint: string,
+    parentLog: Logger,
+    private refreshInterval: number = 1000 * 60 * 3,
+  ) {
+    this.log = parentLog.child({ comp: "privilege-refresher" });
+  }
+
+  public async start() {
+    this.log.info(
+      `Starting privilege refresher with interval ${this.refreshInterval}`,
+    );
+    // Add some jitter to the initial load and the interval.
+    setTimeout(() => this.loadPrivilegeChecker(), Math.random() * 1000);
+    setInterval(
+      () => this.loadPrivilegeChecker(),
+      this.refreshInterval + Math.random() * 1000,
+    );
+  }
+
+  public get(): PrivilegeChecker {
+    return this.privilegeChecker ?? this.failOpenPrivilegeChecker;
+  }
+
+  private async loadPrivilegeChecker(): Promise<void> {
+    this.log.info(`Loading privilege checker from ${this.endpoint}`);
+    try {
+      const response = await fetch(this.endpoint);
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+
+      const cosmeticsData = await response.json();
+      const result = CosmeticsSchema.safeParse(cosmeticsData);
+
+      if (!result.success) {
+        throw new Error(`Invalid cosmetics data: ${result.error.message}`);
+      }
+
+      this.privilegeChecker = new PrivilegeCheckerImpl(
+        result.data,
+        base64url.decode,
+      );
+      this.log.info(`Privilege checker loaded successfully`);
+    } catch (error) {
+      this.log.error(`Failed to fetch cosmetics from ${this.endpoint}:`, error);
+      throw error;
+    }
+  }
+}