feat(grant): positional provider:handle grantees + repo clone URL (COR-699)

Address grantees as github:alice instead of --provider/--provider-user-id flag soup: grant {org,project,repo} add/remove now take a positional <target> <grantee>, resolving the handle to its provider user id via the control plane (new resolveGranteeProvider). remove also accepts an account ULID for the typed-id revoke route. Show the entire:// clone URL in repo get.