Introduce granular permissions for Acquia DAM administration

Problem/Motivation

Currently, all Acquia DAM administration routes (configuration, disconnect, metadata, image styles, integration links, bulk import) rely on the generic administer site configuration permission. This is overly broad and does not follow the principle of least privilege. Site administrators who need to manage Acquia DAM settings are required to have full site configuration access, which may not be desirable in multi-role or enterprise environments.
Additionally, the "Disconnect site" action on the configuration form is visible to anyone who can access the form, regardless of whether they should be allowed to disconnect the site from Acquia DAM.

Steps to reproduce

• Install the acquia_dam module.
• Create a role with only administer site configuration permission.
• Assign the role to a user.
• Observe that the user has full access to all Acquia DAM administration pages, including the ability to disconnect the site — no granular control is possible.

Proposed resolution

Introduce new dedicated permissions:

• administer acquia_dam — Controls access to Acquia DAM configuration, metadata, image styles, integration links, and bulk import pages.

Update all relevant routes in acquia_dam.routing.yml and acquiadam_asset_import.routing.yml to use the new permissions instead of administer site configuration.

Conditionally render the "Disconnect site" link in AcquiaDamConfigurationForm only for users with the administer acquia_dam permission.

Provide a hook_update_N to automatically grant the administer acquia_dam permission to all existing roles that currently have administer site configuration, ensuring a smooth upgrade path with no loss of access for existing administrators.