Fix EZP-23341: incorrect subtree limitation check in section/assign

JIRA: https://jira.ez.no/browse/EZP-23341

If a role exists with a subtree limitation, section/assign check will not consider other (more permissive) roles .
This fixes it by looking at the subtree limitation at each policy, and denying it if subtrees don't match.
This part is a revert of cef569909821cbf393620244ba48a14328b88c53 (EZP-17219 as you mentioned in JIRA) so you should have 2 commits in your PR:
- A revert commit of cef569909821cbf393620244ba48a14328b88c53
- A commit with your actual fix.