Release v4.189.1

Fixed

• The Stage sandbox (Play) now answers role-gated queries and commands as a persona from the model instead of returning 403. Stage picks the persona named by the user menu's role. Without one, it picks the persona that the modules' authorize requirements admit, and otherwise the first declared persona. The persona's roles and claims come from its policies. Incoming x-ms-client-principal headers are removed and Arc's forwarded-identity trust stays off, so a caller cannot choose another identity or add roles. This applies only in sandbox mode, which the Stage Docker image turns on. Rendered applications and hosted deployments are unchanged. Set Stage__Sandbox__Identity=false to turn it off. (#664) (part of #599)