Automated cherry pick of #36197 (#36382)

* [MM-68393] Tighten protected role patch authorization (#36197)

* [MM-68393] Tighten protected role patch authorization

Harden role patch authorization for protected system roles and cover the restricted paths with focused API tests.

Made-with: Cursor

* [MM-68393] Fix role patch test shadowing

Rename shadowing response variables in the protected role patch tests so govet passes in core and enterprise check-style jobs.

Made-with: Cursor

* [MM-68393] Block privileged role permissions

Made-with: Cursor
(cherry picked from commit 99b73d4c4acf5ff3546c2548a5aaa804c2aa1b04)

* Fix role patch tests for release-10.11 context and LoginSystemManager APIs

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Nick Misasi <nick.misasi@mattermost.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

server/channels/api4/role.go

@@ -151,9 +151,9 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) {
 	auditRec.AddEventPriorState(oldRole)
 	auditRec.AddEventObjectType("role")
 
-	// manage_system permission is required to patch system_admin
+	// manage_system permission is required to patch system_admin and other protected system roles.
 	requiredPermission := model.PermissionSysconsoleWriteUserManagementPermissions
-	specialProtectedSystemRoles := append(model.NewSystemRoleIDs, model.SystemAdminRoleId)
+	specialProtectedSystemRoles := append(append([]string{}, model.NewSystemRoleIDs...), model.SystemAdminRoleId, model.SystemUserRoleId, model.SystemGuestRoleId)
 	for _, roleID := range specialProtectedSystemRoles {
 		if oldRole.Name == roleID {
 			requiredPermission = model.PermissionManageSystem