[6.x] Hide permissions covered by a broader permission

[jasonvarga]

Permissions may now declare one or more permissions that hide them in the roles UI:

$this->permission('view {container} assets')->hiddenBy('configure asset containers');
$this->permission('edit {form} form')->hiddenBy(['configure forms', 'edit forms']);

When any of the hiding permissions are checked, the permission and its children disappear from the roles UI. Unchecking brings them back, with their checked state intact.

This is purely visual. It doesn't grant anything, and it doesn't establish a hierarchy between permissions. It just avoids showing redundant checkboxes, cleaning up the UI.

The concept is cherry-picked from #14957, where it was introduced as supersededBy as part of Forms 2. It's extracted here so it can land on its own, renamed, and widened to accept multiple permissions.

Core permissions

The configure permissions already grant every ability their policies guard, eg. configure collections -> view {collection} entries.

Fixes coming along for the ride

Publish state on new entries

EntriesController::create() resolved canManagePublishState from the raw publish {collection} entries permission, which sidesteps EntryPolicy and falls through to Gate::after. Users able to configure collections were denied the publish state toggle, despite the policy granting them everything. It now goes through the policy, matching the edit page.

Permission descriptions

Permissions using replacements(), and their children, are rebuilt when the tree is generated. That rebuild never copied the description across, so publish {collection} entries and reorder {collection} entries have never shown theirs in the roles UI, despite having one in lang/en/permissions.php. Fixed alongside the same bug affecting hiddenBy.

Tests

Nothing asserted that the configure permissions actually grant the abilities behind the permissions we're now hiding. Added user_with_configure_permission_can_do_it_all to EntryPolicyTest and TermPolicyTest, and view/edit coverage to GlobalSetVariablesPolicyTest. Navs and assets were already covered.