RANGER-5793: Align delegated-admin checks for policy update and delet…

[vyommani]

What changes were proposed in this pull request?

RangerPolicyAdminImpl.isDelegatedAdminAccessAllowed() authorizes a modify on the access-type
delta between the submitted and stored policy. An empty delta was substituted with _admin, which
any delegateAdmin=true item satisfies regardless of access-type. The delta is empty for a DELETE
(stored policy is passed as-is) and for changes to isEnabled, policyPriority,
validitySchedules, conditions, isDenyAllElse or the delegateAdmin flag, so a delegated-admin
holding a single access-type on a resource could delete/disable/re-prioritize a policy whose other
access-types are outside their delegation.

• getAllModifiedAccessTypes(): empty delta → full access-type set of the stored policy, same as
  the existing resource-changed branch.
• isPolicyScopeChanged(): a change to any of the fields above routes to the resource-changed
  branch (full set on old and new policy), so bundling one with an otherwise-permitted access-type
  change does not bypass the check.
• collectAccessTypes(): one Set per principal; the shared instance let addAll() for one
  principal leak into others and hide real changes.

Behaviour change: a delegated-admin with partial scope on a policy can no longer delete, toggle,
re-prioritize, re-scope or grant delegateAdmin on it (they could not read it before either).
Access-type add/remove is still authorized on the delta only. All changes are deny-only.

How was this patch tested?

• TestRangerPolicyAdminImpl: delete/disable/re-prioritize/delegateAdmin-toggle/combined-change
  denied for partial scope and allowed for full scope; delta-only regression guard;
  isPolicyScopeChanged per field; per-principal set isolation; recursive flip (RANGER-1718).
• TestServiceREST: deletePolicy(id) → 403 when the modify check fails, store not called.
• Manual on ranger-in-docker: partial-scope delegated-admin gets 403 on DELETE, disable, priority
  change and the combined PUT (previously 204/200); full-scope user still succeeds.