Integrate permission scope into binding and migration logic

•  Update RelationApiDualWriteSubjectHandler to use permission scope for determining binding levels
• Update migration tool to consider permission scope when creating role bindings
• Add comprehensive integration tests for scope-based role binding
• Fix all scope-related tests to use proper settings and scope mapping

Roles now bind to appropriate scopes based on their permissions:

• Tenant-level apps bind to tenant
• Root-level apps bind to root workspace
• Default apps bind to default workspace 
• Mixed permission roles bind to highest scope level