Fixes #26795

Adds an opt-in feature flag that disambiguates local accounts from SSO users during RBAC enforcement, resolving the ambiguous group assignment problem described HERE.

When rbac.local.user.strictmode: "true" is set in the argocd-cm ConfigMap, Argo CD appends an @local suffix to local account names during RBAC enforcement only. This prevents an SSO user whose scope happens to match a local user's name from inheriting that local user's roles.

Behavior summary:

• Reference local users in RBAC policies with the suffix, e.g. g, sally@local, role:developer.
• Users still log in as sally (CLI/UI) , the @local suffix only affects RBAC matching.
• The UI user info section displays the @local identity when strict mode is on, so operators know which subject to reference.
• The built-in admin account is granted role:admin for both admin and admin@local, preserving default admin access.
• This is disabled by default. When unset, local names are matched verbatim (existing behavior is unchanged).

TL;DR

When you create a local user like this with this setting:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
data:
  rbac.local.user.strictmode: "true" # New option, defaults to "false" preserving current behavior
  accounts.sally: apiKey,login

You have to do this for RBAC now:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:  # Note the @local is needed now ⌄
  policy.csv: |
    g, sally@local, role:admin
  policy.default: role:readonly
  scopes: '[groups, email]'