ReviewAccessRequest RPC does not respect Machine ID Role Impersonation

[strideynet]

Expected behavior:

When interacting with the ReviewAccessRequest RPC and my identity is in a state of role impersonation, whether or not I am able to review a request should be based on the roles I have impersonated rather than the roles my user directly holds.

Current behavior:

The ReviewAccessRequest RPC fetches the users roles and evaluates based on those rather than the roles currently associared with the identity. This prevents Machine ID bot credentials from being able to review access requests as part of our plugins.

Suggested fix:

Following discussion, we will add support for evaluating role impersonation correctly. The code will ensure that the impersonated roles are a subset of the users impersonatable roles - this prevents recursive impersonation via access requests.

[strideynet]

Part of #29048