GO-6473 Restrict Admin role transitions to owner-only in ACL validator

[requilence]

Summary

Tighten the ACL validator so the Admin permission can only be granted, revoked, or removed by the space Owner. Previously any author with CanManageAccounts() (Owner or Admin) could perform these operations, allowing admins to escalate other members. This PR aligns the validator with the product requirement that only owners control admin membership.

Validator changes (commonspace/object/acl/list/validator.go):

• ValidatePermissionChange: granting Admin or revoking from a current Admin requires Owner.
• ValidateAccountRemove: removing an Admin member requires Owner.
• ValidateAccountsAdd: adding a new account at Admin level requires Owner.
• ValidateInvite / ValidateInviteChange: creating or repointing an invite at Admin level requires Owner.
• ValidateRequestAccept: approving a join request at Admin level requires Owner.

Helper (commonspace/object/acl/list/models.go):

• New AclPermissions.IsAdmin() for clarity at call sites.

Test plan

• New unit tests cover each restriction:
  • TestAclList_AdminCannotGrantAdmin
  • TestAclList_AdminCannotRevokeAdmin
  • TestAclList_OwnerCanGrantAndRevokeAdmin
  • TestAclList_AdminCannotRemoveAdmin
  • TestAclList_AdminCannotAddNewAdmin
  • TestAclList_AdminCannotIssueAdminInvite
  • TestAclList_AdminCannotApproveAsAdmin
  • TestAclPermissions_IsAdmin
• Existing TestAclExecutor updated to keep Admin-introducing operations under the owner.
• New TestSettingsObject_DeleteObject_Restricted_AdminCanDelete confirms admins still pass the per-tree DeleteRestricted gate (CanManageAccounts()), unchanged.
• Full any-sync test suite passes (go test ./...).

Companion PR

The downstream consumer in anytype-heart depends on these validator changes. See companion PR in anytype-heart (link in comments after creation).

[requilence]

Companion PR in anytype-heart: anyproto/anytype-heart#3136

[github-actions]

New Coverage	56.7% of statements
Patch Coverage	81.8% of changed statements (27/33)

---

^{Coverage provided by https://github.com/seriousben/go-patch-cover-action}