fix: correct user self management on metadata and delete (#10666)

# Which Problems Are Solved

This PR fixes the self-management of users for metadata and own removal
and improves the corresponding permission checks.
While looking into the problems, I also noticed that there's a bug in
the metadata mapping when using `api.metadata.push` in actions v1 and
that re-adding a previously existing key after its removal was not
possible.

# How the Problems Are Solved

- Added a parameter `allowSelfManagement` to checkPermissionOnUser to
not require a permission if a user is changing its own data.
- Updated use of `NewPermissionCheckUserWrite` including prevention of
self-management for metadata.
- Pass permission check to the command side (for metadata functions) to
allow it implicitly for login v1 and actions v1.
- Use of json.Marshal for the metadata mapping (as with
`AppendMetadata`)
- Check the metadata state when comparing the value.

# Additional Changes

- added a variadic `roles` parameter to the `CreateOrgMembership`
integration test helper function to allow defining specific roles.

# Additional Context

- noted internally while testing v4.1.x
- requires backport to v4.x
- closes https://github.com/zitadel/zitadel/issues/10470
- relates to https://github.com/zitadel/zitadel/pull/10426

(cherry picked from commit 5329d50509)

internal/actions/object/metadata_test.go

@@ -0,0 +1,122 @@
+package object
+
+import (
+	"testing"
+
+	"github.com/dop251/goja"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/zitadel/zitadel/internal/domain"
+)
+
+func TestMetadataListToDomain(t *testing.T) {
+	type args struct {
+		metadataList *MetadataList
+	}
+	tests := []struct {
+		name string
+		args args
+		want []*domain.Metadata
+	}{
+		{
+			name: "nil",
+			args: args{metadataList: nil},
+			want: nil,
+		},
+		{
+			name: "empty",
+			args: args{metadataList: &MetadataList{}},
+			want: []*domain.Metadata{},
+		},
+		{
+			name: "from mapped value",
+			args: args{metadataList: &MetadataList{
+				metadata: []*Metadata{
+					{
+						Key:   "key1",
+						value: []byte("value1"),
+					},
+				},
+			}},
+			want: []*domain.Metadata{
+				{
+					Key:   "key1",
+					Value: []byte("value1"),
+				},
+			},
+		},
+		{
+			name: "from goja value string",
+			args: args{metadataList: &MetadataList{
+				metadata: []*Metadata{
+					{
+						Key:   "key1",
+						Value: (&goja.Runtime{}).ToValue("value1"),
+					},
+				},
+			}},
+			want: []*domain.Metadata{
+				{
+					Key:   "key1",
+					Value: []byte(`"value1"`),
+				},
+			},
+		},
+		{
+			name: "from goja value int",
+			args: args{metadataList: &MetadataList{
+				metadata: []*Metadata{
+					{
+						Key:   "key1",
+						Value: (&goja.Runtime{}).ToValue(1),
+					},
+				},
+			}},
+			want: []*domain.Metadata{
+				{
+					Key:   "key1",
+					Value: []byte("1"),
+				},
+			},
+		},
+		{
+			name: "from goja value float",
+			args: args{metadataList: &MetadataList{
+				metadata: []*Metadata{
+					{
+						Key:   "key1",
+						Value: (&goja.Runtime{}).ToValue(1.2),
+					},
+				},
+			}},
+			want: []*domain.Metadata{
+				{
+					Key:   "key1",
+					Value: []byte("1.2"),
+				},
+			},
+		},
+		{
+			name: "from goja value bool",
+			args: args{metadataList: &MetadataList{
+				metadata: []*Metadata{
+					{
+						Key:   "key1",
+						Value: (&goja.Runtime{}).ToValue(true),
+					},
+				},
+			}},
+			want: []*domain.Metadata{
+				{
+					Key:   "key1",
+					Value: []byte("true"),
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, MetadataListToDomain(tt.args.metadataList))
+		})
+	}
+}