Fix extension loading and integer role handling on CakePHP 5

[arodu]

Problem

Two issues break the plugin on CakePHP 5:

1. Extension loading. Service::_loadExtensions() and
   Action::_loadExtensions() still read the CakePHP 4 shape returned by
   ObjectRegistry::normalizeArray() ($properties['class'] /
   $properties['className']). Since CakePHP 5, normalizeArray() returns a
   name => config map and only sets className for plugin-prefixed names, so:

   • a service with any configured extension fails with
     ObjectRegistry::load(): Argument #1 ($name) must be of type string, null given
     (src/Service/Service.php:925);
   • an app extension without a plugin prefix (e.g. UserFormatting) fails the
     same way (src/Service/Action/Action.php:397).

2. Integer roles. ApiRbac::checkPermissions() passes the role straight to
   the RBAC rules, but CakeDC\Auth\Rbac\Rules\Rule::allowed() types it as
   string. Apps that store the role as an integer group id get
   Rule::allowed(): Argument #2 ($role) must be of type string, int given
   (src/Rbac/ApiRbac.php:194).

Changes

• Service::_loadExtensions(): iterate normalizeArray() as $name => $config
  and call $registry->load($name, $config).
• Action::_loadExtensions(): call $registry->load($name, $properties), which
  works for both plugin-prefixed and app extensions.
• ApiRbac::checkPermissions(): cast the role to string before it is matched
  and passed to the rules.

Tests

• tests/TestCase/Service/ExtensionLoadingTest.php: a service with a configured
  extension and an action with a plugin-less app extension both load without a
  TypeError.
• tests/TestCase/Rbac/ApiRbacTest.php (+ RoleCapturingRule): an integer role
  is passed to the rule as a string.

All three tests fail on the current 12.x-cake5.0 with the TypeErrors above and
pass with the fix. Full suite: OK (130 tests, 503 assertions).

Notes

• No behaviour change for string roles or plugin-prefixed extensions.
• _matchPermission() keeps its untyped $role; the cast in
  checkPermissions() covers both the permission matching and the rule call.
• The same fix is proposed for 13.x-cake5.4 in a separate PR.