Granular RBAC for Applications

# Summary

Allow configuring more granular RBAC for applications to, e.g., allow rollback or allowing parameters or allow editing sync policy without allowing editing the entire application manifest.

# Motivation

Company controls require that most configuration changes must be approved and landed to version control; however, rolling back an application is permissible because it would be rolled back to a previously approved and landed configuration.

This is similar to, but broader than, the enhancement requested in #6916.

# Proposal

In:

```
p, , , , /
```

- `` could be extended to optionally allow sub-resources, e.g. `application/source/helm/parameters` or `application/syncPolicy`
- `` could be extended to include `rollback` as an option for applications

Start by reviewing the existing RBAC policy syntax shown in the proposal and the broader enhancement in #6916. Clarify how sub-resources and the rollback action should be represented, then verify that the resulting permissions distinguish rollback, parameter changes, sync-policy edits, and full manifest editing.

Written by the indexing model from the issue text.