IAM: Add disabled field to role permissions

This change adds support for disabling permissions without removing them
from roles. This allows users to revoke permissions while signaling to
apps that the permission should not be re-granted.

Key changes:
- Add disabled boolean field to RolespecPermission in CUE schema
- Update generated Go types for Role, CoreRole, and GlobalRole
- Add disabled column to permission table via migration
- Filter disabled permissions in Zanzana tuple conversion
- Filter disabled permissions in legacy RBAC queries
- Update SQL queries to persist and retrieve disabled field

When a permission has disabled: true:
- It remains visible in the role definition
- It is NOT written to Zanzana (authorization engine)
- It is NOT returned in RBAC permission queries

This prevents apps from re-granting permissions that users have
explicitly revoked, while maintaining visibility of the permission
in the role.

pkg/services/accesscontrol/database/database.go

@@ -67,7 +67,9 @@ func (s *AccessControlStore) GetUserPermissions(ctx context.Context, query acces
 			permission.scope
 			FROM permission
 			INNER JOIN role ON role.id = permission.role_id
-		` + filter
+		` + filter + `
+			AND (permission.disabled = 0 OR permission.disabled IS NULL)
+		`
 
 		if len(query.RolePrefixes) > 0 {
 			rolePrefixesFilter, filterParams := accesscontrol.RolePrefixesFilter(query.RolePrefixes)
@@ -132,6 +134,7 @@ func (s *AccessControlStore) GetTeamsPermissions(ctx context.Context, query acce
 			WHERE tr.team_id IN(?` + strings.Repeat(", ?", len(teams)-1) + `)
 			  AND tr.org_id = ?
 		) as all_role ON role.id = all_role.role_id
+		WHERE (permission.disabled = 0 OR permission.disabled IS NULL)
 		`
 
 		params := make([]any, 0)