Enable fine-grained update/delete RBAC enforcement by default

[agaudreault]

Summary

In 2.12 we introduced new RBAC for fine-grained update/delete in #18124. To keep backward compatibility, the applications, update and applications, delete rbac implicitly grant permissions to update/delete application's resources.

Motivation

Streamline behavior that was not possible without breaking changes.

Proposal

With the new fine-grained RBAC, applications, update and applications, delete give permission to manually edit/delete the Application, while applications, update/* and applications, delete/* are used for applications sub-resources.

The built-in policy should be updated to add applications, update/* and applications, delete/* for role:admin to preserve current privilege.