Draft: feat: add deny logic to custom roles permissions

Relates to issue #506173

Changes

• Add support for deny logic in custom roles permissions framework
• Enable users to remove specific permissions from base roles
• Reduce cognitive load in custom role creation process
• Support subtractive permissions alongside existing additive model