Route destination operations should require write permissions in the app's space #5285

Issue

Currently, the permission model for route destination operations is inconsistent with respect to the app's space. The table below shows which roles in the app's space/org are sufficient (assuming the user already has space_developer in the route's space and the route has been explicitly shared with the app's space):

Three problems stand out:

1. Add/Replace: read-only roles (space_manager, space_auditor, org_manager) are sufficient to wire up routing to an app they cannot write to.
2. Update/Delete: no role in the app's space is required at all — any user with write access to the route's space can modify or remove destinations regardless of which space the app lives in.
3. admin_read_only and global_auditor: these read-only global roles can perform all four mutating operations, which contradicts their intended purpose.

Context

No response

Steps to Reproduce

see #5284

Expected Result

No response

Current Result

No response

Possible Fix

Proposed change: All four operations should require space_developer or space_supporter in the app's space. Only admin should be exempt as the global write role.
admin_read_only and global_auditor should be denied just like any other role without write access to the app's space.