Discoverable API endpoints

Certain actions may be disabled by policy, or the user is unauthorized to perform them. Currently, the only way to find out is to try and get a 401 Unauthorized or a 2XX Success status code.

Other actions require certain capabilities (e.g.: live resize). Users have no way to determine if they are able do perform that operation (operation can return a 202 Accepted status code, fail and then revert to the previous state).

Because of this, adding an API endpoint that lists the actions available to the user (for a given target) can be helpful.