fix: check both regular ACEs and resource pool ACEs for proper access control

This fix addresses a critical issue in the RBAC permission checking logic
introduced in PR #2750. When a project is shared through a resource pool,
both the project creator (with regular ACEs like "All endpoints") and the
shared user (with resource pool ACEs) should be able to see the project.

Changes:
- Modified `check_user_has_privilege` in `gns3server/db/repositories/rbac.py`
- Changed from if-elif (exclusive) to sequential (inclusive) checking
- Now checks regular ACEs first, then resource pool ACEs
- Both types of ACEs can grant access (OR logic instead of XOR)

This fixes the scenario where:
1. user100 has "All endpoints" ACE and creates a project
2. user100 shares the project via resource pool with user200
3. Both users should see the project (user100 via regular ACE, user200 via pool ACE)

Related to PR #2750 - RBAC user isolation implementation.

gns3server/db/repositories/rbac.py

@@ -428,22 +428,26 @@ class RbacRepository(BaseRepository):
 
         aces = await self._get_user_aces(user_id, privilege_name)
         try:
+            # Check regular ACEs first
+            if self._check_path_with_aces(path, aces):
+                # the user has an ACE matching the path and privilege, there is no need to check group ACEs
+                return True
+            # Then check resource pool ACEs
             if path_is_in_pool:
                 if await self._get_resources_in_pools(aces, path):
                     return True
-            elif self._check_path_with_aces(path, aces):
-                # the user has an ACE matching the path and privilege, there is no need to check group ACEs
-                return True
         except PermissionError:
             return False
 
         aces = await self._get_group_aces(user_id, privilege_name)
         try:
+            # Check regular ACEs first
+            if self._check_path_with_aces(path, aces):
+                return True
+            # Then check resource pool ACEs
             if path_is_in_pool:
                 if await self._get_resources_in_pools(aces, path):
                     return True
-            elif self._check_path_with_aces(path, aces):
-                return True
         except PermissionError:
             return False
         return False