refactor(acl): NodeAcl.LdapGroup -> Principal, with the proc that reads it (#520)

Stage 1a of the API-key ACL design. Behaviour-neutral: the trie walker already
matched an opaque string, so only what produces that string changes. No
enforcement is wired by this commit and none of the two live role gates move.

Renamed through the ACL model: NodeAcl.Principal, TrieGrant.Principal,
MatchedGrant.Principal, AuthorizationDecision.Principal,
UserAuthorizationState.Principals, and PermissionTrie.CollectMatches's parameter.
LdapGroupRoleMapping is a DIFFERENT entity that also has an LdapGroup column and
is deliberately untouched — it backs AdminUI login, which keeps LDAP.

The migration is the interesting part. EF scaffolds RenameColumn/RenameIndex, so
rows survive — but it cannot know that dbo.sp_ComputeGenerationDiff checksums
NodeAcl.LdapGroup. That proc is created in V3Initial.StoredProcedures and never
redefined since, and SQL Server does not validate a procedure body when a column
is renamed out from under it: the object keeps reporting healthy and fails at
CALL time with Invalid column name, silently breaking config-drift detection.
Verified against the live dev DB that the deployed proc really does reference the
column. The migration therefore re-emits the proc, as one parameterised template
shared by Up and Down so the two cannot drift.

Prose that describes what is enforced TODAY (fleet-wide LDAP group -> role) is
left alone, because it is still accurate until stage 2 lands.

UserAuthorizationState's refresh machinery is retained unchanged but now carries
a note that it is LDAP-shaped and largely vestigial here: an API-key principal
set cannot change out of band, since keys and ACL rows both ride the deployment
artifact, so the generation stamp rather than the freshness timer is the real
invalidation signal.

41 authorization tests pass; solution builds clean.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Entities/NodeAcl.cs

@@ -3,7 +3,7 @@ using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
 namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;
 
 /// <summary>
-///     One ACL grant: an LDAP group gets a set of <see cref="NodePermissions"/> at a specific scope.
+///     One ACL grant: a principal gets a set of <see cref="NodePermissions"/> at a specific scope.
 ///     Generation-versioned per decision. See <c>acl-design.md</c> for evaluation algorithm.
 /// </summary>
 public sealed class NodeAcl
@@ -17,8 +17,8 @@ public sealed class NodeAcl
     /// <summary>Gets or sets the cluster ID for this ACL entry.</summary>
     public required string ClusterId { get; set; }
 
-    /// <summary>Gets or sets the LDAP group for this ACL entry.</summary>
-    public required string LdapGroup { get; set; }
+    /// <summary>Gets or sets the principal (API-key principal name, or the reserved <c>anonymous</c>) this ACL entry grants to.</summary>
+    public required string Principal { get; set; }
 
     /// <summary>Gets or sets the scope kind for this ACL entry.</summary>
     public required NodeAclScopeKind ScopeKind { get; set; }