Improves validation in getRolesByName endpoint (#25215)

* Improves validation in getRolesByName endpoint

* Updates the max constant and fixes linter

* Adds a mechanism to split roles in chunks in the webapp client

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/role.go

@@ -12,6 +12,8 @@ import (
 	"github.com/mattermost/mattermost/server/v8/channels/audit"
 )
 
+const GetRolesByNamesMax = 100
+
 var notAllowedPermissions = []string{
 	model.PermissionSysconsoleWriteUserManagementSystemRoles.Id,
 	model.PermissionSysconsoleReadUserManagementSystemRoles.Id,
@@ -89,6 +91,13 @@ func getRolesByNames(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if len(rolenames) > GetRolesByNamesMax {
+		c.Err = model.NewAppError("getRolesByNames", "api.roles.get_multiple_by_name_too_many.request_error", map[string]any{
+			"MaxNames": GetRolesByNamesMax,
+		}, "", http.StatusBadRequest)
+		return
+	}
+
 	cleanedRoleNames, valid := model.CleanRoleNames(rolenames)
 	if !valid {
 		c.SetInvalidParam("rolename")