feat(security): carry LDAP roles onto session identity (T17)

Stop discarding the authenticator's resolved roles during impersonation.
HandleImpersonation now sets args.Identity to a RoleCarryingUserIdentity
(: UserIdentity) that carries result.Roles, so a downstream method handler
can read them off context.UserIdentity for the inbound AlarmAck gate (T18).

Verified via the decompiled SDK (1.5.378.106) that the instance we assign to
ImpersonateEventArgs.Identity is stored by reference onto Session.Identity /
EffectiveIdentity and surfaced unchanged on OperationContext.UserIdentity --
the custom subclass survives the round-trip. No auth-decision logic changes.

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs

@@ -289,7 +289,7 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
             return;
         }
 
-        args.Identity = new UserIdentity(token);
+        args.Identity = new RoleCarryingUserIdentity(token, result.Roles);
         logger.LogInformation("OpcUaApplicationHost: UserName auth granted for {User} ({Roles})",
             token.UserName, string.Join(",", result.Roles));
     }