Enforce owner-only member removal and ownership grants via policy

An organization ADMIN could hard-remove members, including OWNERs, because
removeUser (connect and MCP) only checked the weaker iam:membership-profile:delete
gate. Authorize the owner-only iam:membership:delete instead, and expose the
source attribute on MembershipProfile so the owner grant's non-SCIM condition
can match.

Consolidate ownership-grant authorization into policy for both createUser and
updateMembership: each resolver passes the requested role as a target_role
attribute and ADMIN is denied granting ownership via deny-create-owner /
deny-promote-owner. target_role is distinct from resource.role, which is the
target's current role and guards editing existing owners. With no callers left,
the iam:membership-role:set-owner action (grant and OAuth2 scope) is removed.

Also pass the authorized scope through to the RemoveUser/CreateUser services,
gate the console Remove action on iam:membership:delete, and add regression
tests plus a changelog entry.

Signed-off-by: Sacha Al Himdani <sacha@probo.com>

pkg/coredata/membership_profile.go

@@ -99,7 +99,8 @@ func (p *MembershipProfile) AuthorizationAttributes(
 SELECT
     id,
     organization_id,
-    identity_id
+    identity_id,
+    source
 FROM
     iam_membership_profiles
 WHERE
@@ -123,9 +124,10 @@ WHERE
 			id             gid.GID
 			organizationID gid.GID
 			identityID     gid.GID
+			source         ProfileSource
 		)
 
-		err = rows.Scan(&id, &organizationID, &identityID)
+		err = rows.Scan(&id, &organizationID, &identityID, &source)
 		if err != nil {
 			return nil, fmt.Errorf("cannot scan profile authorization attributes: %w", err)
 		}
@@ -133,6 +135,7 @@ WHERE
 		attrsByID[id] = policy.Attributes{
 			"organization_id": organizationID.String(),
 			"identity_id":     identityID.String(),
+			"source":          source.String(),
 		}
 	}