KC-1435: Prevent delegated admin privilege escalation by validating user permissions

[sshrushanth-ks]

Summary

Delegated admins without transfer_account, manage_teams, or manage_companies privileges could escalate by granting these privileges to roles they manage, bypassing authorization checks. The require_account_share enforcement setting could also be set by non-root delegated admins, restricting account access for managed users. Privilege grants now verify the current user holds each privilege before allowing the grant, and require_account_share enforcement is restricted to root admins only.

Changes

• enterprise.py:
  • Add privilege possession check before granting sensitive privileges; identify current user from params and extract their role privileges for the managed node; reject grant if user lacks privilege
  • Restrict require_account_share enforcement to root admins; check if current user's roles manage any root nodes (nodes with no parent_id)
• data_enterprise.py: Add test roles and role_privileges data with test privilege assignments for verification
• test_command_enterprise.py: Add 6 security tests covering privilege possession checks, root admin restriction, and regression tests for allowed operations