fix(permissions): scope role dedupe by resource

Tightens app role existence checks in `Add-CIPPApplicationPermission` to match both `appRoleId` and `resourceId` instead of only role ID. This prevents skipping valid role assignments when the same role ID appears across different service principals.

Author: Zacgoose

Modules/CIPPCore/Public/Add-CIPPApplicationPermission.ps1

@@ -122,7 +122,7 @@ function Add-CIPPApplicationPermission {
         if (!$svcPrincipalId) { continue }
 
         foreach ($SingleResource in $App.ResourceAccess | Where-Object -Property Type -EQ 'Role') {
-            if ($SingleResource.id -in $CurrentRoles.appRoleId) { continue }
+            if ($CurrentRoles | Where-Object { $_.appRoleId -eq $SingleResource.id -and $_.resourceId -eq $svcPrincipalId.id }) { continue }
             [pscustomobject]@{
                 principalId = $($ourSVCPrincipal.id)
                 resourceId  = $($svcPrincipalId.id)