Federated server can delete remote private groups

Description:

An administrator can remove a federated channel on a remote system.

Steps to reproduce:

1. I have two sites A and B that are connected via federation.
2. A shares a private channel with a user from B which is Administrator on site B.
3. If B decides to delete the channel, then it is really removed from A

Expected behavior:

A is the owner of the channel, it should not be possible for an admin of site B to remove the channel.

Actual behavior:

As described, B is capable of deleting the remote channel A

Server Setup Information:

• Version of Rocket.Chat Server: 3.9.7
• Operating System: Linux
• Deployment Method: docker
• Number of Running Instances:
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

Client Setup Information

• Desktop App or Browser Version:
• Operating System:

Additional context

Relevant logs:

Start by reproducing the federation setup with sites A and B and a private channel owned by A. Trace the remote channel deletion flow and its administrator authorization checks. Done means an administrator on B cannot delete A's channel, while the owning site retains its expected deletion behavior.