Fix burotel cli

- Don't grant `full_access` when setting specific permissions
- All rooms need to be set to protected
- No rooms should have the prebooking-required flag (since only the ACL is used anyway)

Start by locating the burotel CLI implementation and the code that assigns room permissions and flags. Verify each requested behavior there: specific permissions must not grant full_access, every room must be protected, and no room should require prebooking; done means all three conditions are covered and tested where the project provides tests.

Written by the indexing model from the issue text.