fix: correct user self management on metadata and delete (#10666)

# Which Problems Are Solved

This PR fixes the self-management of users for metadata and own removal
and improves the corresponding permission checks.
While looking into the problems, I also noticed that there's a bug in
the metadata mapping when using `api.metadata.push` in actions v1 and
that re-adding a previously existing key after its removal was not
possible.

# How the Problems Are Solved

- Added a parameter `allowSelfManagement` to checkPermissionOnUser to
not require a permission if a user is changing its own data.
- Updated use of `NewPermissionCheckUserWrite` including prevention of
self-management for metadata.
- Pass permission check to the command side (for metadata functions) to
allow it implicitly for login v1 and actions v1.
- Use of json.Marshal for the metadata mapping (as with
`AppendMetadata`)
- Check the metadata state when comparing the value.

# Additional Changes

- added a variadic `roles` parameter to the `CreateOrgMembership`
integration test helper function to allow defining specific roles.

# Additional Context

- noted internally while testing v4.1.x
- requires backport to v4.x
- closes https://github.com/zitadel/zitadel/issues/10470
- relates to https://github.com/zitadel/zitadel/pull/10426

(cherry picked from commit 5329d50509)

internal/actions/object/metadata.go

@@ -204,7 +204,12 @@ func MetadataListToDomain(metadataList *MetadataList) []*domain.Metadata {
 	for i, metadata := range metadataList.metadata {
 		value := metadata.value
 		if len(value) == 0 {
-			value = mapBytesToByteArray(metadata.Value.Export())
+			var err error
+			value, err = json.Marshal(metadata.Value.Export())
+			if err != nil {
+				logging.WithError(err).Debug("unable to marshal")
+				panic(err)
+			}
 		}
 		list[i] = &domain.Metadata{
 			Key:   metadata.Key,
@@ -214,21 +219,3 @@ func MetadataListToDomain(metadataList *MetadataList) []*domain.Metadata {
 
 	return list
 }
-
-// mapBytesToByteArray is used for backwards compatibility of old metadata.push method
-// converts the Javascript uint8 array which is exported as []interface{} to a []byte
-func mapBytesToByteArray(i interface{}) []byte {
-	bytes, ok := i.([]interface{})
-	if !ok {
-		return nil
-	}
-	value := make([]byte, len(bytes))
-	for i, val := range bytes {
-		b, ok := val.(int64)
-		if !ok {
-			return nil
-		}
-		value[i] = byte(b)
-	}
-	return value
-}