feat(lint): expose the user role's security flags

[jvegmond-tech]

What
Exposes four Security$UserRole settings to Starlark lint rules:
Starlark field Type Studio Pro
check_security bool Security > User roles > role > Check security
manage_all_roles bool Manage all roles
manage_users_without_roles bool Manage users without roles
manageable_roles list of string the roles this role may hand out

Why
All four are already modelled on sdk/security.UserRole and already read from BSON by mdl/backend/modelsdk/security_read.go — UserRoleInfo simply did not carry them, so they stopped at the linter boundary. Nothing about the model or the reader changes here; three struct fields and four dict entries carry values that are already in memory the rest of the way.
Two rules we are porting from CLEVR's ACR set need them, and neither is expressible today:
User roles with a certain amount of module roles should be checked for security — the module-role count is a filter; the assertion is on the per-role "Check security" flag. Without the field a rule can only count module roles, which is a different and much weaker claim (and CONV008 already covers the counting angle).
Only "admin" roles should manage other users — needs the user-management grants.

Changes
mdl/linter/context.go — four fields on UserRoleInfo, populated inUserRoles() from the *security.UserRole already in hand
mdl/linter/starlark.go — exposed on the user_role struct, list conversion following the existing module_roles pattern
.claude/skills/mendix/write-lint-rules/SKILL.md — four rows on theuser_role table (TestLintSkillDocumentsEveryStructField requires them)

No schema bump
Deliberately, and stated here because the last two PRs of mine got this wrong:user_roles() is served by GetProjectSecurity() on the reader, not by a catalog table. mdl/catalog/tables.go is untouched, no createTables column is added, so CatalogSchemaVersion stays at 15 and an existing cache stays valid.
Storage names
Not re-derived — modelsdk/gen/security already binds all four, andsecurity_read.go already calls the getters:

go
Plain Text
o.manageAllRoles = property.NewPrimitive[bool]("ManageAllRoles", property.DecodeBool)o.manageUsersWithoutRoles = property.NewPrimitive[bool]("ManageUsersWithoutRoles", property.DecodeBool)o.checkSecurity = property.NewPrimitive[bool]("CheckSecurity", property.DecodeBool)o.manageableRoles = property.NewByNameRefListelement.Element
None carry the …Name suffix that bit AdminUserRoleName / GuestUserRoleNamein storagename_projectsecurity_test.go, so there is no second key to pin here. Happy to add a storage-name test in that file's style if you'd rather have the four pinned explicitly.

What this enables

python
Plain Text
RULE_ID = "CLEVR012"RULE_NAME = "UserRoleCheckSecurity"DESCRIPTION = "Project roles that carry module roles must have 'Check security' enabled"CATEGORY = "security"SEVERITY = "error" def check(): out = [] for role in user_roles(): if len(role.module_roles) == 0 or role.check_security: continue out.append(violation( message = "User role '{}' has module roles but 'Check security' is off.".format(role.name), location = location(module = "", document_type = "security", document_name = "ProjectSecurity"), suggestion = "Tick 'Check security' on the role and resolve what Studio Pro reports.", )) return out

Testing
make build — OK
go test ./mdl/linter/... — OK
Against a project with a role whose "Check security" is off, then on —