docs: generate the README permissions column from tool declarations

TestReadmeToolPermissions rewrites the tool table's Required RBAC
Permissions column from RequiresPermissions (with -update-readme) and
fails when it drifts or a registered tool has no row. Adds the 20 tools
that were missing from the table and corrects several stale entries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: sd2k

CONTRIBUTING.md

@@ -102,7 +102,7 @@ Run `make lint` and `make test-unit` before pushing. The specifics:
 - **Pass `context.Context` through Grafana API client calls** — enforced by `make lint-openapi`.
 - **Write tools must respect `--disable-write`.** Any tool that creates, updates or deletes anything must be registered so that it disappears when the server runs read-only. Take the `enableWriteTools` parameter in your category's `Add*Tools` function.
 - **Query tools must respect `--disable-query`.** Any tool that executes a query against a datasource must disappear when query execution is disabled. Take the `enableQueryTools` parameter in your category's `Add*Tools` function, and leave metadata and discovery tools registered unconditionally. If the tool passes the query through unfiltered — raw SQL, InfluxQL — it can write, so it counts as a write tool too: add its category to `mutatingQueryCategories` in `cmd/mcp-grafana/main.go` so `--disable-write` removes it.
-- **New tools need a row in the README's tool table**, including the category and the required RBAC permissions and scopes.
+- **New tools declare their RBAC permissions** with `mcpgrafana.RequiresPermissions(...)` on the `MustTool` call (see `tools/rbac.go` for shared groups such as `datasourceQuery`), and **need a row in the README's tool table** with the category and required scopes. The permissions column is generated: run `go test ./cmd/mcp-grafana -run TestReadmeToolPermissions -update-readme`.
 
 The checks that must pass to merge are `license/cla`, `Test Unit`, `Test Integration`, `Lint Go`, `Lint JSON Schemas`, `docker` and `docker-alpine`. `Test Cloud` and the Python E2E suites are informational — `Test Cloud` cannot pass from a fork at all, because it needs credentials, so please don't worry about it being red.