CLI to prune Hasura permissions metadata

[kevinmichaelchen]

CLI should have a subcommand that removes any permission block found in Hasura metadata YAML.

This is to support workflows where permissions are managed externally via permissura and users don't want to maintain two sources of truth.

The recommendation for that workflow is to have a CI migrator call permissura rather than relying on hasura metadata apply. It needs to be clearly documented that hasura metadata apply is something to be avoided in that workflow, since it would have the effect of removing permissions entirely.