fix: multilevel permissions in can() method

[bgeneto]

Refactor authorization checks to support nested permissions in can() method.
Fixes #1224

Description

Changes

• Enhanced permission wildcard matching to properly handle nested levels
• Ensure wildcard behavior to prevent unintended parent/sibling permission access

Example

Given permission admin.settings.theme.*:

• ✅ WILL match: admin.settings.theme, admin.settings.theme.color, admin.settings.theme.layout.dark
• ❌ WON'T match: admin.settings, admin.*

Benefits

• More granular permission control
• Prevents privilege escalation through parent levels
• Maintains backward compatibility with existing permission structure
• Better alignment with hierarchical permission management

Testing

Added comprehensive test cases covering:

• Nested permission levels
• Parent/child permission relationships
• Cross-branch permission validation
• Edge cases and boundary scenarios

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[bgeneto]

Correction: The array_intersect() returns an array, not a boolean, which causes the type warning.