Move the legacy permission writes onto the v2 permission ops

The v2 permission ops (BA-7560) expose set / widen / revoke over permission rows and the field rows narrowing them. The permission-controller writes still go through the legacy CreatorSpec path and cannot carry a field list.

Scope:
- Point PermissionControllerDBSource.replace_role_permissions and update_role_permissions at the v2 permission ops.
- Drop PermissionCreatorSpec / PermissionPurgerSpec once nothing uses them.
- Keep the repository and service signatures; only the write path underneath moves.

JIRA Issue: BA-7579

Start at PermissionControllerDBSource.replace_role_permissions and update_role_permissions, then trace the v2 permission ops and all remaining uses of PermissionCreatorSpec and PermissionPurgerSpec. Done means both writes use the v2 operations, obsolete specs have no remaining users and are removed, and the repository and service signatures remain unchanged.

Written by the indexing model from the issue text.