[CORE-40] add read_spend_report action to workspace owners

[calypsomatic]

Ticket: https://broadworkbench.atlassian.net/browse/CORE-40

What:

Adds a read_spend_report action on workspaces, and grants it to workspace owners.

Why:

<For your reviewers' sake, please describe in ~1 paragraph what the value of this PR is to our users or to ourselves.>

How:

<For your reviewers' sake, please describe in ~1 paragraph how this PR accomplishes its goal.>

<If the PR is big, please indicate where a reviewer should start reading it (i.e. which file or function).>

---

PR checklist

• I've followed the instructions if I've made any changes to the API, especially if they're breaking changes
• I've filled out the Security Risk Assessment (requires Broad Internal network access) and attached the result to the JIRA ticket

[marctalbott]

This is all you'll need in Sam. The other actions that are present in the code are actions that Sam requires for its own internal operations (e.g. read_policies is required to read the Sam policies on a resource). Adding it to Sam's config like this is sufficient for an action like this that governs an operation in an upstream service.