fix: #3621035 Grant the SEO Admin role the meta tag and sitemap administration permissions

Fixes #3621035.

The SEO Admin role returned 403 on the two primary SEO configuration screens, /admin/config/search/metatag and /admin/config/search/simplesitemap, while reaching URL aliases and redirects normally. Both routes work for a Super Admin, so the modules and routes are present — the role was simply never granted the permissions.

Two permissions added to the user.role.seo_admin grant already in this recipe:

• administer meta tags — provided by metatag
• administer sitemap settings — provided by simple_sitemap

Both machine names were read from the modules' own *.permissions.yml rather than guessed. Both are restrict access: TRUE upstream, which is expected for administrative settings screens and appropriate for a role named for SEO administration.

Why here and not in varbase_users_base, which defines the role: this recipe is what installs metatag and simple_sitemap, so it is what brings those permissions into existence. At the point varbase_users_base runs they do not yet exist, so the grant cannot live there.

content_editor, content_admin and site_admin are deliberately unchanged — the report is about SEO Admin, and whether site_admin should also carry these is a separate judgement.

Reported from Varbase Starter, Educare and Horizon Aid, identically on all three.

AI-Generated: Yes

Checkpoints:

• File an issue
• Addition/Change/Update/Fix
• Testing to ensure no regression
• Automated unit testing coverage
• Automated functional testing coverage
• UX/UI designer responsibilities
• Readability
• Accessibility
• Performance
• Security
• Developer Documentation
• User Guide Documentation
• Reviewed by human
• Code review by maintainers
• Full testing and approval
• Credit contributors
• Review with the product owner
• Release notes snippet
• Release