RBAC validator foundation for BEP-1048

Foundation work to align the RBAC action validator infrastructure with BEP-1048 3-Type Model (guarded/auto/ref) and RBACElementType.

Current validator chain (BaseScopeAction → ScopeActionRBACValidator → PermissionControllerRepository → PermissionDBSource) uses legacy ScopeType/EntityType and flat scope matching. This epic introduces:

- CTE-based scope chain traversal for hierarchical permission checks (auto/ref edge awareness)

- RBACElementRef unified reference type (replacing separate ScopeId/ObjectId in RBAC contexts)

- RBACElementType bridge on BaseScopeAction

- BatchActionRBACValidator implementation

All changes are additive — existing functions and types remain unchanged.

Reference: rbac-validator-foundation-gaps.md in project root

Related: BEP-1048, BA-4179, BA-2946

JIRA Issue: BA-4617

Start with rbac-validator-foundation-gaps.md in the project root, then trace the listed validator chain from BaseScopeAction through PermissionDBSource. Use BEP-1048 and the related issues as context for the CTE traversal, RBACElementRef, RBACElementType, and batch validator requirements. Done means these additive foundation changes are implemented without changing existing functions or types.

Written by the indexing model from the issue text.