Fix EZP-23341: incorrect subtree limitation check in section/assign

JIRA: https://jira.ez.no/browse/EZP-23341

If a role exists with a subtree limitation, section/assign check will not consider other (more permissive) roles .
This fixes it by looking at the subtree limitation at each policy, and denying it if subtrees don't match.