Fix user group ACL UI permission keys

[Ibochkarev]

What changed and why

The user-group ACL grids checked usergroup_create. That string is a Form Customization lexicon key, not an Access Policy permission, so userCanCreate was always false. The Add Context/Category/Source/Namespace/Resource Group buttons ignored that flag and stayed visible.

This PR:

• Uses usergroup_new + usergroup_save for those Create buttons (getCreateAclButton on UserGroupBase).
• Hides New User Group (tree toolbar and context menu) without usergroup_new and usergroup_save.
• Hides Add User unless the manager has both usergroup_user_edit and usergroup_user_list, so turning off list no longer leaves the user combo as a side door.
• Drops the “delete or remove” wording on delete_role in English.

Parent-menu hiding (access_permissions), tab vs direct URL, and processor-only new without save are unchanged. Those belong with #16595 and the rest of the 2019 ACL series.

How to test

1. Administrator: Access Control Lists still shows Add Context (and the other Add ACL buttons) and New User Group.
2. Policy without usergroup_new or without usergroup_save: those Create controls are hidden. Security/Group/Create still requires only usergroup_new if called directly.
3. Policy without usergroup_user_list, with usergroup_user_edit: Add User is hidden in the tree and on the group users grid. Users in group grid stays hidden (existing behavior).
4. Gate E (this session):
   • php -l on touched PHP: exit 0
   • core/vendor/bin/phpunit -c _build/test/phpunit.xml --filter AccessPermissionUiTest --no-coverage: OK (10 tests, 34 assertions)
   • core/vendor/bin/phpcs --standard=phpcs.xml _build/test/Tests/Model/Security/AccessPermissionUiTest.php: exit 0

Related issue(s)/PR(s)

Refs #14497 (does not close the full 2019 inventory). Related: #14406, #14434, #16595.

Compatibility notes

Manager UI only. Connector permission checks are unchanged. Safe for 3.x patch.

Breaking change assessment

No public API, processor, or policy-template change. Managers who relied on Add User without usergroup_user_list lose that UI path. The Users page (view_user) is unchanged.

Test coverage

_build/test/Tests/Model/Security/AccessPermissionUiTest.php asserts Group/Create uses usergroup_new, the ExtJS keys/factory, tree/Add User gates, and the English delete_role line.

Contributors

@Ruslan-Aleev reported the ACL group in #14497.

AI tool use

Cursor agent (Composer) implemented the fix, tests, and this description from the issue and the 3.x re-check comment on #14497.