[LSO] Streamlining of Permission Handling (remove JOIN/LEAVE, migrate to READ)

[kevenClausenKPG]

Context / Feature request

This PR implements the JourFixe decision (18 MAY 2026) according to the feature wiki entry:

• https://docu.ilias.de/go/wiki/wpage_6707_1357

JourFixe, ILIAS (18 MAY 2026) clarified:

• This request removes the permissions JOIN and LEAVE (shown as Subscribe/Unsubscribe in the permission tab).
• The membership service stays (users can still be added/removed manually as participants).
• Migration: roles with JOIN and/or LEAVE permission will receive READ permission.

---

Problem

The Learning Sequence (lso) previously used participate/unparticipate (JOIN/LEAVE) for starting/finishing, leading to confusing and error-prone permission setups compared to other ILIAS objects.

---

Changes

1) Unify access handling to read

• Removed reliance on RBAC operations participate and unparticipate for launching/starting.
• Launch/start permissions are now based on checkAccess('read', ...).
• Leaving (unparticipate) is no longer controlled by RBAC unparticipate, but by:
  • user is a member (isMember()), and
  • user has read.
• ilObjLearningSequenceGUI::unparticipate() now checks read and only calls leave() if the user is actually a member.

2) Clean up permission/command offering

• Removed the unparticipate permission command from ilObjLearningSequenceAccess::_getCommands().
• This ensures there is no remaining code path that expects unparticipate as a configurable permission for lso.

3) DB migration + remove legacy ops from the lso type

• Added setup DB update steps for the Learning Sequence component:
  • Migrate rbac_pa entries for lso: convert participate and/or unparticipate permissions to read.
  • Remove participate and unparticipate from the type operation assignment (rbac_ta) for lso so Subscribe/Unsubscribe no longer appear in the permission tab.

Migration / upgrade behavior

• After upgrade, any role that previously had participate and/or unparticipate on Learning Sequences will have read.
• The legacy operations participate/unparticipate are no longer available for lso in the permission tab.
• Membership service unchanged