Impersonation allows elevating role

I tried to give the user manager permission to impersonate other users. However, this would enable the user manager to impersonate an admin, which could result in a security breach. Is there a way to restrict this, for example by only allowing impersonation of users with the same or lower permissions, or by not allowing admins to be impersonated in general?

**Version and Deployment (please complete the following information):**

- authentik version: 2025.8.3
- Deployment: docker-compose

No file, test, or entry point is named. Start by locating the impersonation permission and role checks in the authentik codebase, then define the expected behavior for same-or-lower permissions and protected administrators; done means an impersonator cannot gain privileges through impersonation and the behavior is covered by tests.

Written by the indexing model from the issue text.