Access: Remove plugin app access in plugin basic role seeder (#108526)

* draft: remove plugin app access in plugin basic role seeder

* fix log

* remove mods to gosum

* fix missing plugin check

* debug log, not warn

* Secrets: Better error message for not matching resource owner (#109113)

---------

Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>

pkg/services/accesscontrol/acimpl/service.go

@@ -430,6 +430,11 @@ func (s *Service) RegisterFixedRoles(ctx context.Context) error {
 		for br := range accesscontrol.BuiltInRolesWithParents(registration.Grants) {
 			if basicRole, ok := s.roles[br]; ok {
 				for _, p := range registration.Role.Permissions {
+					if registration.Role.IsPlugin() && p.Action == pluginaccesscontrol.ActionAppAccess {
+						s.log.Debug("Plugin is attempting to grant access permission, but this permission is already granted by default and will be ignored",
+							"role", registration.Role.Name, "permission", p.Action, "scope", p.Scope)
+						continue
+					}
 					perm := accesscontrol.Permission{
 						Action: p.Action,
 						Scope:  p.Scope,