Load extensions by normalized name and cast RBAC role to string

[arodu]

CakePHP 5 compatibility fixes:

• Extension loading — normalizeArray() now returns name => config (the
  class/config shape is gone), so Service/Action::_loadExtensions()
  passed null to load() and threw.
• RBAC role — the role is forwarded to rules typed string $role; integer
  roles (group ids) threw a TypeError. Now cast to string.

Adds regression tests (ExtensionLoadingTest, ApiRbacTest) that fail before
the fix. Plugin suite (130 tests) and a downstream app suite (1789 tests) pass.

Also adds config.policy.advisories.ignore: ["league/flysystem"] so the
testsuite job can composer update (it was blocked by flysystem 1.x
advisories pulled by the flysystem-vfs dev-dependency).

Refs #43963.