Setup security permissions for max and timeout

[basejump]

we need a way to say if a user has access to specific items and not do it by role.
lets try PreQueryEvent

2 use cases that we need out of the gate

max

• Default max in config should be set to 100
• Override this for a user

timeout

• default should be set back to 30s
• Override this for a user (such as Rob)
• Should be a check to never be able to exceed 3m (can be a config item)

From original issue:

look into hasAuthority for more fine grained permissions, the 6.0 docs have better docs on it in sprinc sec
https://docs.spring.io/spring-security/reference/5.8/servlet/authorization/expression-based.html
https://docs.spring.io/spring-security/reference/5.8/servlet/authorization/method-security.html

[snimavat]

#800