feat: impersonation roles (#7442)

* partial work done

* test IAM membership roles

* org membership tests

* console :(, translations and docs

* fix integration test

* fix tests

* add EnableImpersonation to security policy API

* fix integration test timestamp checking

* add security policy tests and fix projections

* add impersonation setting in console

* add security settings to the settings v2 API

* fix typo

* move impersonation to instance

---------

Co-authored-by: Livio Spring <[email protected]>

console/src/assets/i18n/zh.json

@@ -187,12 +187,16 @@
     "IAM_OWNER_VIEWER": "有权审查整个实例，包括所有组织",
     "IAM_ORG_MANAGER": "有权创建和管理组织",
     "IAM_USER_MANAGER": "有权创建和管理用户",
+    "IAM_ADMIN_IMPERSONATOR": "有权模拟所有组织的管理员和最终用户",
+    "IAM_END_USER_IMPERSONATOR": "有权模拟所有组织的最终用户",
     "ORG_OWNER": "拥有整个组织的权限",
     "ORG_USER_MANAGER": "有权创建和管理组织的用户",
     "ORG_OWNER_VIEWER": "有权审查整个组织",
     "ORG_USER_PERMISSION_EDITOR": "有权管理用户授权",
     "ORG_PROJECT_PERMISSION_EDITOR": "有权管理项目授权",
     "ORG_PROJECT_CREATOR": "有权创建自己的项目和基础设置",
+    "ORG_ADMIN_IMPERSONATOR": "有权模拟组织的管理员和最终用户",
+    "ORG_END_USER_IMPERSONATOR": "有权模拟组织的最终用户",
     "PROJECT_OWNER": "拥有整个项目的权限",
     "PROJECT_OWNER_VIEWER": "有权审查整个项目",
     "PROJECT_OWNER_GLOBAL": "拥有整个项目的权限",
@@ -1159,9 +1163,13 @@
       "UPDATED": "设置已更新。"
     },
     "SECURITY": {
-      "DESCRIPTION": "此设置将CSP设置为允许来自一组允许的域的框架。请注意，通过启用iFrames的使用，你会有允许点击劫持的风险。",
+      "IFRAMETITLE": "iFrame",
+      "IFRAMEDESCRIPTION": "此设置将CSP设置为允许来自一组允许的域的框架。请注意，通过启用iFrames的使用，你会有允许点击劫持的风险。",
       "IFRAMEENABLED": "允许 iFrame",
-      "ALLOWEDORIGINS": "允许的来源 URL"
+      "ALLOWEDORIGINS": "允许的来源 URL",
+      "IMPERSONATIONTITLE": "冒充",
+      "IMPERSONATIONENABLED": "允许模拟",
+      "IMPERSONATIONDESCRIPTION": "此设置原则上允许使用模拟。请注意，模拟者还需要分配适当的 `*_IMPERSONATOR` 角色。"
     },
     "DIALOG": {
       "RESET": {