IdentityUserRolesSource

INTERIM default UserRolesSource: identity passthrough — the granted userRoleId is handed back unchanged as the "resolved" access id.

This is explicitly a stop-gap, NOT the real resolution. The engine keys restricted entities on the CMS accessRestrictionId, not the auth userRoleId. The passthrough is safe-but-unenforcing: the engine (core-engine dev/reza ba243c78+) treats an unknown non-empty accessLevelId as the DEFAULT level, so an unresolved id can never over-grant — it just cannot select a specific restriction level either.

TODO(backend): replace as the default with NetworkUserRolesSource once the backend deploys the userRoleId -> accessRestrictionId resolution endpoint and publishes its URL.