Provide a way to filter out infra grants in the /api/grants API #3800

Infra's clients (Dashboard and CLI) need to filter out grants that assign access to infra (i.e. Infra API itself), but there isn't an easy way to do this in the API.

The GET /api/grants endpoint should hide these grants by default, and allow for showing them via ?showSystem=true (similar to what is used elsewhere) or ?showInfra=true.