Add role-based folder access control

[scottgrayson]

Summary

This PR adds role-based folder access control to the library package while keeping it decoupled from Spatie Permission.

Changes

• Add role checker callback pattern to FilamentLibraryPlugin (similar to libraryAdminCallback)
• Create library_item_role_permissions table migration
• Add LibraryItemRolePermission model
• Extend LibraryItem with role-based permission checks:
  • hasRoleRestrictions() - Check if item/parent has role restrictions
  • getRequiredRoleNames() - Get all required roles (including inherited)
  • hasRoleAccess() - Check if user has required role
  • Updated getEffectiveRole() and hasPermission() to check role restrictions first
• Add role permissions UI fields to CreateFolder and EditFolder pages
• Support role restrictions that inherit from parent folders

Architecture

The package uses callback patterns to remain decoupled from Spatie Permission:

• setRoleCheckerCallback() - Projects implement role checking
• setAvailableRolesCallback() - Projects provide available roles for UI

Testing

• Test folder access with role restrictions
• Test role restriction inheritance from parent folders
• Test that users without required roles cannot access folders
• Test that library admins bypass role restrictions

[scottgrayson]

Closing as superseded by the per-user permission model shipped in v1.3.5/v1.3.7 (#32, #34).

The resource library contract uses explicit library_item_permissions per user, with roles only as assignment filters via the host-owned assignment.filter_provider — not role-gated folder visibility.

If role-based folder restrictions are needed in the future, they should be redesigned from main rather than revived from this branch.