Fix role permission authorization checks

[kevinherron]

Motivation

• The previous authorization logic treated any UserRolePermissions entry with a permission bit as sufficient, ignoring whether the entry’s roleId was assigned to the current session, which allowed role-based authorization bypasses.

Description

• Require that a UserRolePermissions entry both has the requested PermissionType bit and that its roleId is present in the session’s mapped role IDs by adding a shared hasPermission(...) helper and using it in all affected checks.
• Replace unchecked Stream.anyMatch(rp -> rp.getPermissions().getX()) checks with hasPermission(roleIds, ..., PermissionType::getX) across read/write RolePermissions, Historizing, browse, call, add reference, delete node, and delete reference paths in DefaultAccessController.
• Add PermissionType import and a Predicate<PermissionType>-based helper to encapsulate the role-id match plus permission bit test in DefaultAccessController.
• Add a regression unit test checkRolePermissionAccess_DeniesPermissionsForUnassignedRoles to cover the mismatched-role scenarios across read, write, browse, call, add reference, delete node, and delete reference in DefaultAccessControllerTest.

---

Codex Task