🚀 RBAC: Conditional permission policies support for `defaultPermissions`

### Workspace

rbac

### 🔖 Feature description

Add support for conditional permission policies for the `defaultPermissions` defined in app configuration.

### 🎤 Context

I want to provide all logged in users in Backstage access to the catalog, but restrict the entities they see based on conditional policies.

For example we have some scaffolder templates we only want "admins" to be able to see and run. So we put `spec.permission: admin` on those template and could filter them with the `HAS_SPEC` rule.

The `defaultPermissions` only allow definition of basic permissions, so I can only allow full read access to the whole catalog.
Also writing a conditional policy in the `conditionalPoliciesFile` referencing the `defaultRole` does not work with an error:
```
skip to add condition for role 'role:default/default'. The role either does not exist or was not created from a CSV file.
```

### ✌️ Possible Implementation

On the PR implementing the `defaultPermissions` https://github.com/backstage/community-plugins/pull/7571 in the demo video is a commented-out section visible for a `conditionalPermissions` array.
Defining it like that in the app configuration and then persist in the database is coherent with the current implementation of the `basicPermissions`.

### 👀 Have you spent some time to check if this feature request has been raised before?

- [x] I checked and didn't find similar issue

### 🏢 Have you read the Code of Conduct?

- [x] I have read the [Code of Conduct](https://github.com/backstage/community-plugins/blob/main/CODE_OF_CONDUCT.md)

### Are you willing to submit PR?

Yes I am willing to submit a PR!

Start by reviewing the implementation of `defaultPermissions` from community-plugins PR #7571, then trace how `basicPermissions`, `conditionalPoliciesFile`, and the `defaultRole` are handled. Define the expected configuration shape for conditional policies and how those policies are persisted and applied. Done means logged-in users receive the configured default permissions while conditional rules can filter catalog entities such as scaffolder templates.

Written by the indexing model from the issue text.