Backport RBAC (openedx-authz) bug fixes to release/verawood #513

Context

Since release/verawood was cut, several RBAC (openedx-authz) fixes have been merged into master. They correct wrongful 403s, crashes with platform-wide (glob) role assignments, and inconsistent permission gates. These fixes are not yet in release/verawood. Verawood is still on openedx-authz==1.21.0, while master is already on 1.23.0.

Goal

Backport to release/verawood the RBAC bug-fix PRs already merged into master, so Verawood doesn't carry permission regressions that are already resolved.

Scope

Includes: permission/role/authz fixes (Studio, Content Libraries, Instructor Dashboard) and the reverts that correct a previous backport.

Excludes:

• New RBAC features, unless a fix needs them as a dependency (see "To evaluate").
• Refactors, automated bumps, and test or lint fixes.

Backport criteria

• Use git cherry-pick -x from the master commit.
• If a fix depends on code or an openedx-authz version that Verawood doesn't have, backport the dependency first or drop the PR.
• Each backport PR targets release/verawood, references the original PR, and passes the relevant tests.
• One PR per commit, so each change can be tested on its own. The title keeps the original title with the PR number replaced by [verawood]. The earlier all-in-one PR (#39198) was closed in favor of these.

Backport PRs

All are drafts against release/verawood. In the "Tested" column, ⬜ means pending and ✅ means validated on its own. The status icon of each PR (draft, open, merged) is shown by GitHub next to its link.

Independent (PR created)

Depend on a parent PR (branch ready, PR not created yet)

These do not apply without their parent. Their PR is opened once the parent is merged.

Dependencies between PRs

• #39284 -> #38980
• #39288 -> #39055
• #39293 -> #39050
• #39285 -> #39196
• All the split read vs write PRs and anything using view_* permissions require openedx-authz 1.23.0 (#39282).

Resolved decisions

• Revert #38973: included (revert: Cannot rerun courses - authz role assignment expects rerun to already exist [verawood] openedx-platform#39283). Verawood has #38840 as #38858, so it needs the revert.
• openedx-authz bump: included (chore: upgrade openedx-authz==1.23.0 [verawood] openedx-platform#39282). Required by #38973 (>= 1.22.0) and the view_* permission PRs (1.23.0).
• Features needed as dependencies: #39013, #39007, #39008, #39009, #39010 and #39113 were included. #39013 and #39009 are real dependencies of #39050 and #39055. #39112 was also included (it is a fix needed for the XBlock menu gate).

Not included yet

• #38721 – add missing org scope support in instructor dashboard
• #39073
• #39107
• #39197
• Gradebook fails with UnboundLocalError in BulkRoleCache.prefetch (authz compat roles loop) #514

Tasks

• Verify that each PR applies on release/verawood and identify dependencies.
• Resolve the openedx-authz bump and revert #38973.
• Create the backport PRs (one per commit; the 4 dependent ones are pending their parent).
• Validate tests on each PR and merge, parents first.
• Open the 4 dependent PRs once their parent is merged.
• Decide on #38721, #39073, #39107 and #39197.