AccessControl: Include hidden roles in service account role display (#112924)

* AccessControl: Include hidden roles in service account role fetches

Add includeHidden=true parameter to role API calls to ensure service accounts
with hidden roles assigned properly display those roles in the UI.

Previously, service accounts with only hidden roles would appear to have no
roles assigned in the UI, even though the API showed they had roles when
queried with includeHidden=true.

This change affects both:
- Bulk role fetching for the service accounts list
- Individual user role fetching used by the role picker

* format

public/app/core/components/RolePicker/api.ts

@@ -16,7 +16,7 @@ export const fetchRoleOptions = async (orgId?: number): Promise<Role[]> => {
 };
 
 export const fetchUserRoles = async (userId: number, orgId?: number): Promise<Role[]> => {
-  let userRolesUrl = `/api/access-control/users/${userId}/roles?includeMapped=true`;
+  let userRolesUrl = `/api/access-control/users/${userId}/roles?includeMapped=true&includeHidden=true`;
   if (orgId) {
     userRolesUrl += `&targetOrgId=${orgId}`;
   }

public/app/features/serviceaccounts/state/actions.ts

@@ -63,7 +63,10 @@ export function fetchServiceAccounts(
           dispatch(rolesFetchBegin());
           const orgId = contextSrv.user.orgId;
           const userIds = result?.serviceAccounts.map((u: ServiceAccountDTO) => u.id);
-          const roles = await getBackendSrv().post(`/api/access-control/users/roles/search`, { userIds, orgId });
+          const roles = await getBackendSrv().post(`/api/access-control/users/roles/search?includeHidden=true`, {
+            userIds,
+            orgId,
+          });
           result.serviceAccounts.forEach((u: ServiceAccountDTO) => {
             u.roles = roles ? roles[u.id] || [] : [];
           });