test: improve policy authorization mutation coverage

[UmairRathore]

Related to #8053

📝 Summary

Improves mutation coverage for PolicyAuthorizationService by strengthening tests around authorization short-circuiting and managed group ID normalization.

The change is test-only and does not modify production behavior.

The added and strengthened tests verify that:

• Instance admins return before subadmin authorization is consulted.
• Regular users return before managed group lookup is attempted.
• Managed group IDs are trimmed.
• Empty managed group IDs are discarded.
• Duplicate managed group IDs are removed.
• The result is re-indexed as a list<string>.

Mutation testing results

Metric	Before	After
PHPUnit tests	11	12
Assertions	14	16
Mutants generated	30	30
Mutants killed	24	30
Escaped mutants	6	0
Mutation Code Coverage	100%	100%
Covered Code MSI	80%	100%

🧪 How to test

Run the focused PHPUnit test:

composer test:unit -- --filter PolicyAuthorizationServiceTest

Expected result:

OK (12 tests, 16 assertions)

Run the focused Infection mutation test:

composer mutation:test -- \
  lib/Service/Policy/PolicyAuthorizationService.php \
  --test-framework-options="--filter PolicyAuthorizationServiceTest" \
  --show-mutations \
  --no-progress \
  --no-interaction

Expected result:

30 mutations were generated:
      30 mutants were killed by Test Framework

Mutation Code Coverage: 100%
Covered Code MSI: 100%

⚙️ API / Back-end changes

• Strengthened PolicyAuthorizationServiceTest authorization short-circuit assertions.
• Added coverage for managed group ID trimming, empty-value filtering, deduplication, and list re-indexing.
• Unit tests added/updated.
• Capabilities updated (not applicable).
• Documentation updated (not applicable).
• API documentation updated (not applicable).

✅ Checklist

• I have read and followed the contribution guide.
• The change is limited to tests/php/Unit/Service/Policy/PolicyAuthorizationServiceTest.php.
• Focused PHPUnit tests pass.
• Focused Infection mutation testing passes with 100% Covered Code MSI.
• No production code or mutation-testing configuration was changed.
• The commit includes the required DCO sign-off.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI