RBAC: Validate plugin app access permission targets the plugin (#59468)

* RBAC: Validate plugin app access permission targets the plugin

* Fix service test

pkg/services/accesscontrol/pluginutils/utils_test.go

@@ -122,12 +122,23 @@ func TestValidatePluginRole(t *testing.T) {
 			role: ac.RoleDTO{
 				Name: "plugins:test-app:reader",
 				Permissions: []ac.Permission{
-					{Action: "plugins.app:access"},
+					{Action: "plugins.app:access", Scope: "plugins:id:test-app"},
 					{Action: "test-app:read"},
 					{Action: "test-app.resources:read"},
 				},
 			},
 		},
+		{
+			name:     "invalid permission targets other plugin",
+			pluginID: "test-app",
+			role: ac.RoleDTO{
+				Name: "plugins:test-app:reader",
+				Permissions: []ac.Permission{
+					{Action: "plugins.app:access", Scope: "plugins:id:other-app"},
+				},
+			},
+			wantErr: &ac.ErrorInvalidRole{},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {