Prevent Privilege Escalation: Add Assignment Restrictions for Roles and Permissions

[maliming]

Resolve #24768

Problem Description

The system has privilege escalation issues:

1. Manager with AbpIdentity.Users.Update.ManageRoles permission can add Admin role to themselves or others
2. User with AbpIdentity.Users.ManagePermissions or AbpIdentity.Roles.ManagePermissions permission can grant others permissions they don't have
3. Users can bypass restrictions by modifying their own user permissions or permissions of roles they belong to

Solution

This PR introduces 3 core security mechanisms:

1. Role Assignability Control (for ManageRoles permission)

• Add AssignableRoles configuration to each role, specifying which other roles it can assign
• After Manager configures AssignableRoles: [Sales, Support], can only assign these 2 roles, cannot assign Admin

2. Permission Grant Authority Validation (for ManagePermissions permission)

• Check users can only grant permissions they possess
• User with permissions 1, 2 can only grant permissions 1, 2 to others, cannot grant permission 3

3. Self-Modification Protection (for all management permissions)

• Block non-Admin users from modifying their own user permissions (AbpIdentity.Users.ManagePermissions)
• Block non-Admin users from modifying permissions of roles they belong to (AbpIdentity.Roles.ManagePermissions)
• Block non-Admin users from adding new roles to themselves (AbpIdentity.Users.Update.ManageRoles)
• Admin role is exempt from above restrictions

New Permission Rules

Role Assignment Rules (AbpIdentity.Users.Update.ManageRoles):

• Users with this permission can only assign roles configured in their role's AssignableRoles
• User's own roles are implicitly included in assignable list (users with "Manager" role can always assign "Manager" to others, even if not explicitly configured)
• If role doesn't configure AssignableRoles, no restriction (backward compatible)
• Admin role can assign any role

Permission Grant Rules (AbpIdentity.Users.ManagePermissions and AbpIdentity.Roles.ManagePermissions):

• Users with these permissions can only grant permissions they possess
• Admin role can grant any permission

Self-Modification Rules:

• Non-Admin users cannot use AbpIdentity.Users.ManagePermissions to modify their own user permissions
• Non-Admin users cannot use AbpIdentity.Roles.ManagePermissions to modify permissions of roles they belong to
• Non-Admin users cannot use AbpIdentity.Users.Update.ManageRoles to add new roles to themselves (can only remove)
• Admin role can modify their own permissions and roles

Effect Comparison

Scenario	Before	Now
Manager (has ManageRoles) adds Admin role to self	✅ Success	❌ Blocked
Manager (has ManageRoles) assigns Admin role to others	✅ Success	❌ Blocked (if not configured in AssignableRoles)
Manager assigns Manager role to others (not in AssignableRoles)	✅ Success	✅ Success (implicit)
User (has ManagePermissions) grants permissions they don't have	✅ Success	❌ Blocked
Non-Admin user (has Users.ManagePermissions) modifies own permissions	✅ Success	❌ Blocked
Non-Admin user (has Roles.ManagePermissions) modifies own role permissions	✅ Success	❌ Blocked
Admin modifies own permissions	✅ Success	✅ Success
Manager assigns configured roles	✅ Success	✅ Success

UI