fix: enforce authoritative roles in IDOR level 4

[tobymoreno]

Summary

• ignore the client-controlled Base64 role cookie in IDOR Level 4
• load the caller role from the database using the verified token identity
• retain owner access and permit cross-user access only for database-confirmed administrators
• reject tokens whose user no longer exists in the database

Validation

• ./gradlew test --tests org.sasanlabs.service.vulnerability.idor.IDORVulnerabilityTest
• ./gradlew spotlessCheck test
• git diff --check

[github-actions]

🏆 VulnerableApp — CTF Patch Score

░░░░░░░░░░░░░░░░░░░░  2 / 187 pts  (1%)

1 / 110 challenges patched

Per-challenge detail is withheld — it would reveal the rubric.

Commit: c33c622 · scoring run

🎉 Your result is on the leaderboard — see where you rank! 🏆