Add restriction rules on job container access

[GuilloteauQ]

In OAR2.5, once a job container has been created, anyone can submit a job in this container.

It would be nice if the user submitting the job container can indicate the level of permission for this container.

I have two scenarios in mind:

• a user is preparing a practical tutorial and reserve some resources with a job container so that the participants of the tutorial have directly access to the machines. In this case, the permission would be at the project level: all the users belonging to the same project as the one specified in the submission of the job container can submit inside the container.

• a user has a lot of jobs to execute. Instead of submitting them all to OAR directly, the user submits a job container that will host all the jobs. In this case, the permission level would be the username. Which I thought would be the default behavior.

An example of potential interface:

oarsub -t container  -l ...

then the container is only accessible by the submitting user.

oarsub -t container=our_project  -l ...

then the container is accessible to all the users belonging in the our_project project.