Ignore disabled permission grants during ACL checks

[francescodifilippo]

When a permission such as Overall/Manage is disabled after being assigned to a role, Folder-based Authorization Strategy can continue granting it.

This change checks whether each assigned permission is enabled when evaluating access. It prevents disabled grants from granting access directly or through implied permissions, while preserving access through enabled broader permissions, including Overall/Administer.

The fix applies to the shared ACL implementation used by global, folder, and agent roles. Existing role configuration is preserved.

Addresses SECURITY-3062 / CVE-2025-24401.

Related: PR #110. This change focuses on authorization-time checks, including permissions disabled after ACL construction, and adds regression coverage.

Testing done

Executed locally with Eclipse Temurin Java 21 and Apache Maven 3.9.16:

• Added four parameterized regression cases covering global and scoped ACLs, permission disabling/re-enabling, and permission implication.
• Ran those tests against the original upstream ACL: all four failed with the expected assertion failures.
• Restored the fix and ran the focused suite: all six tests passed.
• Ran mvn verify: all 48 tests passed, with no failures, errors, or skipped tests. HPI packaging and SpotBugs passed.
• Spotless was skipped by the existing project configuration.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

Francesco Di Filippo