fix(keycloak): bind ReadOnly permission to explicit resources to prevent multi-team isolation bypass

[waterWang]

Problem

The ReadOnly scope-based permission is created with resources: [] (unbound), which matches every resource carrying GET/LIST/MENU scopes in Keycloak — including per-team resources like Dag:team-b. This shadows the correctly built ReadOnly-{team} aggregate permissions and grants read access on role alone, bypassing team isolation.

Fix (4 changes)

1. Bind ReadOnly to explicit global resources — both in _get_permissions_to_create (non-teams and teams) and in _attach_default_role_permissions, so the permission covers only non-team resources (Dag, Connection, Pool, Variable, Team, Asset, AssetAlias, Configuration) instead of matching everything.

2. Expand ReadOnly-{team} to all team-scoped resources — previously only covered Dag:{team} and Team:{team}. Now covers all TEAM_SCOPED_RESOURCE_NAMES (Connection, Dag, Pool, Team, Variable), consistent with the Admin-{team} permission.

3. Expand Admin global permission to include global resources — under --teams, the global Admin permission now covers both team and global resources, so Admin users can interact with shared (teamless) resources as documented.

4. Set resource_names explicitly in _attach_default_role_permissions for both ReadOnly and Admin permissions — replaces resource_names=[] with the full list of known resources, preventing unbound-scope leakage.

Test

Modified tests in test_commands.py to reflect the new resource bindings.

Fixes #71277