Realm takeover via composite-blind role authorization

Privilege escalation in Red Hat build of Keycloak with FGAP v2 enabled allows remote authenticated users to gain realm-wide administration. The role-assignment authorization check evaluates the requested composite role but does not inspect its inherited roles before permitting the mapping. A delegated administrator with permission to map the outer role can therefore assign a composite containing full administrative control.