MM-58548 Remove manage_team permissions from System Console Ancillary permissions (#27395)

* remove manage team permissions from sysconsole_write_user_management_chanels and sysconsole_write_user_management_groups

* update migrations, add unit tests

* run migrations-extract

* make updating ancillary permissions a post

* update file names

* add new api to doc, update body to just be []string

* revert moving ancillary permissions to post

* fix queries after final testing

* Update channel.go

* Update channel.go

* Update 000124_remove_manage_team_permission.up.sql

* Update 000124_remove_manage_team_permission.up.sql

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/group_test.go

@@ -439,6 +439,14 @@ func TestLinkGroupTeam(t *testing.T) {
 		assert.NotNil(t, groupSyncable)
 	})
 
+	t.Run("System manager without invite_user are allowed to link", func(t *testing.T) {
+		th.SystemManagerClient.Login(context.Background(), th.SystemManagerUser.Email, th.SystemManagerUser.Password)
+		groupSyncable, response, err = th.SystemManagerClient.LinkGroupSyncable(context.Background(), g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam, patch)
+		require.NoError(t, err)
+		CheckCreatedStatus(t, response)
+		assert.NotNil(t, groupSyncable)
+	})
+
 	t.Run("Custom groups can't be linked", func(t *testing.T) {
 		gid := model.NewId()
 		gCustom, appErr := th.App.CreateGroup(&model.Group{
@@ -555,6 +563,14 @@ func TestLinkGroupChannel(t *testing.T) {
 		assert.NotNil(t, groupSyncable)
 	})
 
+	t.Run("System manager without invite_user are allowed to link", func(t *testing.T) {
+		th.SystemManagerClient.Login(context.Background(), th.SystemManagerUser.Email, th.SystemManagerUser.Password)
+		groupSyncable, response, err = th.SystemManagerClient.LinkGroupSyncable(context.Background(), g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel, patch)
+		require.NoError(t, err)
+		CheckCreatedStatus(t, response)
+		assert.NotNil(t, groupSyncable)
+	})
+
 	t.Run("Custom groups can't be linked", func(t *testing.T) {
 		gid := model.NewId()
 		g2, appErr := th.App.CreateGroup(&model.Group{
@@ -667,6 +683,13 @@ func TestUnlinkGroupTeam(t *testing.T) {
 		CheckOKStatus(t, response)
 	})
 
+	t.Run("System manager without invite_user are allowed to link", func(t *testing.T) {
+		th.SystemManagerClient.Login(context.Background(), th.SystemManagerUser.Email, th.SystemManagerUser.Password)
+		response, err = th.SystemManagerClient.UnlinkGroupSyncable(context.Background(), g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam)
+		require.NoError(t, err)
+		CheckOKStatus(t, response)
+	})
+
 	t.Run("Custom groups can't get unlinked", func(t *testing.T) {
 		gid := model.NewId()
 		g2, appErr := th.App.CreateGroup(&model.Group{
@@ -778,6 +801,13 @@ func TestUnlinkGroupChannel(t *testing.T) {
 		CheckOKStatus(t, response)
 	})
 
+	t.Run("System manager without invite_user are allowed to link", func(t *testing.T) {
+		th.SystemManagerClient.Login(context.Background(), th.SystemManagerUser.Email, th.SystemManagerUser.Password)
+		response, err = th.SystemManagerClient.UnlinkGroupSyncable(context.Background(), g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel)
+		require.NoError(t, err)
+		CheckOKStatus(t, response)
+	})
+
 	t.Run("Custom groups can't get unlinked", func(t *testing.T) {
 		gid := model.NewId()
 		g2, appErr := th.App.CreateGroup(&model.Group{