fix: keep unmigrated legacy roles working under the authz authoring flag (#38855)

Granting and exercising course creator access crashed once
authz.enable_course_authoring was on. The courses.create_course
permission was implemented in AuthZ, but the course creator role itself
was never migrated there. The code deciding whether to use the AuthZ path
only checked the flag's state, not whether the specific role had actually
been migrated, so unmigrated roles like course creator still used the
AuthZ path and crashed.

enable_authz_course_authoring now takes an optional role and falls back
to the course creator role's own check for any role without a migrated
AuthZ equivalent, regardless of the flag. See ADR 0027.

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>