Ignore IDOR level 3 role cookie

[r1kka6]

Summary

• stop trusting the client-controlled role_level3 cookie for authorization
• derive the effective role from the validated token claims only
• update the Level 3 unit test to reject cookie-based admin escalation

Verification

• ./gradlew test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline lets Alice read Bob by changing role_level3=USER to role_level3=ADMIN
• patched runtime keeps Alice's own profile as USER and rejects id=2 even when role_level3=ADMIN is supplied