assign roles without privilege escalation

[vera]

What this PR does / why we need it:

This PR changes what permissions are required to assign a role.

Previously, only "Manage{Dataset,Dataverse,File}Permissions" was required. However, this allows giving yourself or someone else permissions you don't already have.

E.g. if you have the "ManageXPermissions" permission, you could use it to make yourself admin. This issue has been pointed out before, e.g. here https://groups.google.com/g/dataverse-community/c/wZfSTBiJuPQ/m/N_WXj6nPAAAJ

A possible solution was suggested here: #7252 (comment) When assigning a role, we could compare the permission bits of the assigning user and the assigned role. If the assigned role has any permission bit the assigning user doesn't have, the role assignment is forbidden.

This PR basically implements this fix. For assigning a role, the assigning user must have all of the permissions that the assigned role has.

Which issue(s) this PR closes:

Closes #9358

Special notes for your reviewer:

/

Suggestions on how to test this:

I extended this test: mvn test -Dtest="DatasetsIT#testAddRoles"

Without the changes in AssignRoleCommand, the extended test fails:

[INFO] Results:
[INFO] 
[ERROR] Failures: 
[ERROR]   DatasetsIT.testAddRoles:1688 expected: <401> but was: <200>
[INFO] 
[ERROR] Tests run: 1, Failures: 1, Errors: 0, Skipped: 0

With the changes, it passes.

Does this PR introduce a user interface change? If mockups are available, please link/include them here:

/

Is there a release notes update needed for this change?:

not sure

Additional documentation:

/

cc @johannes-darms

[coveralls]

coverage: 20.278% (+0.003%) from 20.275%
when pulling c0c247e on vera:assign-roles-without-privilege-escalation
into de45c13 on IQSS:develop.

[qqmyers]

Thanks! Looks good. Can you add a note in the Guides about how this works and add a ~one line release note?

[vera]

Thanks for reviewing! Sure, just did.

[poikilotherm]

Such an "easy" fix! I ❤️ it @vera ! Great job in figuring this one out, much appreciated!