Ignore IDOR level 4 encoded role cookie

[r1kka6]

Summary

• stop trusting the Base64-encoded role_level4 cookie for authorization
• derive the effective role from the validated token claims only
• update Level 4 unit coverage to reject encoded admin escalation attempts

Verification

• ./gradlew test spotlessJavaCheck bootJar --no-daemon passed in an eclipse-temurin:17-jdk container
• vulnerable baseline lets Alice read Bob by changing role_level4 to Base64 ADMIN (QURNSU4)
• patched runtime keeps Alice's own profile as USER and rejects id=2 even when role_level4=QURNSU4 is supplied