Modify fhir-smart behavior for "user/" scope requests

[lmsurpre]

Is your feature request related to a problem? Please describe.
In the current implementation, we require the access token to have a patient_id claim for basically any search for resource types that can exist in the patient compartment.

However, for access tokens with user/ or system/ scopes, that feels a bit inconsistent with our isAllowed implementation which basically allows access to any resources when the access token contains a scope with a valid permission for the current interaction (e.g. user/Patient.read for searching patient resources).

This leads to confusing behavior like what is reported at https://chat.fhir.org/#narrow/stream/212434-ibm/topic/Custom.20Sort.20Parameters/near/275813474 where a search of the Basic endpoint with a scope like user/Basic.read ends in 0 results but a whole-system search with the same scope can retrieve these resources just fine.

Describe the solution you'd like

1. Only require the patient_id claim for patient/ scopes (and only when a corresponding user/ or system/ scope doesn't cover the interaction).
2. Only scope searches to the patient compartment when the patient/ scope is the only one that allows the interaction.

Describe alternatives you've considered
more clearly document that the patient_id claim is required even for user/ scopes and ensure that these are enforced properly as part of whole-system search.

Acceptance Criteria

1. GIVEN a server with multiple patient resources (a, b, c)
   AND a valid access token with patient_id=a and scope=launch/patient patient/*.read
   WHEN a search request would return a resource type that is in the the patient compartment
   THEN only resources in the compartment of patient a are returned

2. GIVEN a server with multiple patient resources (a, b, c)
   AND a valid access token with scopes that include user/*.read (with or without a patient_id claim)
   WHEN a search request would return a resource type that is in the the patient compartment
   THEN all resources that meet the search criteria are returned without regard to any patient_id claim/context

3. GIVEN a server with multiple patient resources (a, b, c)
   AND a valid access token with scopes that include system/*.read (with or without a patient_id claim)
   WHEN a search request would return a resource type that is in the the patient compartment
   THEN all resources that meet the search criteria are returned without regard to any patient_id claim/context

Additional context
See https://chat.fhir.org/#narrow/stream/212434-ibm/topic/GET.20Patients and https://chat.fhir.org/#narrow/stream/212434-ibm/topic/fhir-smart/near/264451208 for related discussion.

[d0roppe]

Verified that this is working as outlined in the Acceptance criteria above. Closing issue.