Feature proposal: Custom Roles support with granular organization permissions

[sacha-athias-wmx]

Hi maintainers,

I would like to propose and validate a Custom Roles implementation for organization memberships in Vaultwarden, with granular permissions aligned to Bitwarden-style keys.

Why this feature

Organization authorization is currently mostly role-tier based (Owner/Admin/Manager/User).
For many teams, this is too coarse and can force broader access than needed.

The goal is to support least-privilege delegation, for example allowing someone to manage users or groups without full admin power.

What is implemented

• Database support: added a nullable permissions field on organization membership records (users_organizations), with migrations for sqlite, mysql, and postgresql.

• Typed permission model: added an OrganizationUserPermissions structure and permission enum for these keys: accessEventLogs, accessImportExport, accessReports, createNewCollections, editAnyCollection, deleteAnyCollection, manageGroups, managePolicies, manageSso, manageUsers, manageResetPassword, manageScim.

• Payload and persistence flow: invite/edit member flows now parse, validate, and persist custom permissions.
  Authorization guards: introduced granular organization guards for manageUsers, manageResetPassword, manageGroups, and managePolicies.

• Permission resolution behavior: Admin/Owner keep full access, and custom permissions are evaluated for delegated members.
  Compatibility and fallback behavior

Compatibility and fallback behavior

• Existing memberships without custom permissions keep working.

• Existing admin/owner semantics are preserved.

• Legacy collection-wide behavior is handled with a fallback mapping to collection management permissions where relevant.

• Unknown or missing permissions do not grant access.

Validation done

• Formatting check passed.

• Compile check passed with sqlite feature set.

• Targeted organization permission tests passed, including parsing and round-trip behavior.

#7638