Add support for Team level authorization in Atlas/WebAPI

Expected behavior

New feature request: Following-up on the recent "read restricted" feature introduced in https://github.com/OHDSI/WebAPI/issues/2222 and documented at https://github.com/OHDSI/WebAPI/wiki/Read-restricted-Configuration, it would be nice to have a way to assign permissions on artifacts (like concept sets and cohort definitions) to a group/team of users, so members of the same team can see and use each others artifacts, while at the same time hiding them/restricting their access for other teams.

Actual behavior

Currently any user sees all artifacts created by all other users. With the recent "read restricted" feature referenced above, it is also possible to let the user see only the artifacts he has personally authored.

Background info

Below are some figures and diagrams clarifying the requirements (taken from slides recently presented in one of our dev calls).

Diagram steps explained:

1. user X selects "team A" (during or after login)
2. authorization service is queried to check if user X is really part of "team A"
3. if authorization is successful, the sec_user_role table is updated for user X, assigning the corresponding "team A" role to user X and removing any other user roles assigned to this user (e.g. "team B" from a previous session by this same user)
4. and 5. subsequent requests done by user X, like a call to retrieve the list of cohort definitions, will automatically result in a filter being applied in the backend, narrowing down the result set to just the items owned by "team A" role

Start with the linked read-restricted configuration and trace the authorization service flow, the sec_user_role table updates, and cohort-definition retrieval. Map how team selection, membership checks, role replacement, and artifact filtering should interact. Done means team-owned artifacts are visible to team members but restricted from other teams, with the existing personal-access behavior preserved.