[Bug] Multi-role does not forbid user if proxy superuser

### Search before reporting

- [x] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Read release policy

- [x] I understand that [unsupported versions](https://pulsar.apache.org/contribute/release-policy/#supported-versions) don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.

### User environment

Cluster deployed with Apache Pulsar Helm Chart master (v4.2.0)
Broker version : 4.0.5

### Issue Description

The proxy and broker are configured with Openid authentification :
```yaml
authenticationEnabled: "true"
authenticationProviders: org.apache.pulsar.broker.authentication.oidc.AuthenticationProviderOpenID
PULSAR_PREFIX_openIDAllowedAudiences: pulsar-au
PULSAR_PREFIX_openIDAllowedTokenIssuers: https://token.issuer.com
PULSAR_PREFIX_openIDRoleClaim: scope
```

The proxy and broker are configured with Oauth2 client authentication :
```yaml
brokerClientAuthenticationParameters: '{"privateKey":"file:///pulsar/auth//credentials_file.json","audience":"pulsar-aud","issuerUrl":"https://token.issuer.com","scope":"pulsar-"}'
brokerClientAuthenticationPlugin: org.apache.pulsar.client.impl.auth.oauth2.AuthenticationOAuth2
```

Broker authorization config :
```
authorizationEnabled: "true"
tokenAuthClaim: scope
superUserRoles: pulsar-broker,pulsar-proxy
proxyRoles: pulsar-proxy
```

I create 2 topics :
* `tenant1/ns1/topic1` with permissions `produce/consume` for role `role1`
* `tenant2/ns2/topic2` with permissions `produce/consume` for role `role2`

When the broker `authorizationProvider` is the default, my client with role `role1` can produce only to `tenant1/ns1/topic1`.

But when I set broker `authorizationProvider=org.apache.pulsar.broker.authorization.MultiRolesTokenAuthorizationProvider`, my client with `role1` can produce to both topics. I don't know if it's due to proxy superuser role ?

I don't know how to test it in `MultiRolesTokenAuthorizationProviderTest` ?

### Error messages

```text

```

### Reproducing the issue

See previous

### Additional information

_No response_

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Start with MultiRolesTokenAuthorizationProviderTest and the reported proxy, broker, and authorization configuration. Reproduce the role1 access to both topics with MultiRolesTokenAuthorizationProvider, compare it with the default provider, and establish whether the proxy superuser role causes the unexpected access; done means role1 is restricted to its permitted topic.

Written by the indexing model from the issue text.