Switch invitation/sharing writes to Virtual Scope entity_memberships with permission_cap

Move the live sharing/invitation write path (currently writing ref rows in association_scopes_entities, e.g. vfolder/group) to add the shared entity as a member of the invitee scope's Virtual Scope with a permission_cap. Association (ownership) writes go to the owner VS membership (no cap). The cap clips effective permission (role permission and entity_cap) so sharing cannot escalate. Part of BEP-1062 (#12842) section 3.(e).

Success Criteria
- [ ] Sharing/invitation writes create an invitee-VS entity_membership with permission_cap instead of an association ref row
- [ ] Ownership writes create owner-VS entity_memberships (no cap)
- [ ] permission_cap clips effective permission so an invitee cannot exceed the granted cap
- [ ] pants test passes for affected packages

JIRA Issue: BA-6877

Start with BEP-1062, section 3.(e), then trace the live sharing and invitation write path that currently writes association_scopes_entities references for entities such as vfolders and groups. Identify the corresponding ownership writes and affected packages before running their pants tests. Done means invitee Virtual Scope memberships use permission_cap, ownership uses uncapped owner memberships, and effective permissions cannot exceed the cap.

Written by the indexing model from the issue text.