Label scoped RBAC policies are rejected by the role dialog, so roles that use them cannot be edited

[Ujjwal-Gowda]

POLICIES_STRING_REGEX in web/src/constants/project.ts does not allow the
{key:value} label block that a resource can carry, so the Add Role and Edit
Role dialogs reject any policy that scopes a resource by labels:

resources=application{env:prod};actions=get        -> "Invalid policy format"
resources=application{env:prod,team:foo};actions=get -> "Invalid policy format"
resources=application{env:prod},piped;actions=get  -> "Invalid policy format"

The rest of the stack supports labels:

• ProjectRBACResource has a labels map in pkg/model/project.proto
• parseRBACPolicies parses the {...} block (RESOURCES_LABELS_REGEX)
• formalizePoliciesList writes the {...} block back out

The worst part is editing. EditRoleDialog fills the textarea with
formalizePoliciesList(...), which emits the label block, and validates it
with POLICIES_STRING_REGEX. So opening a role that uses labels shows a form
that is already invalid according to its own validation, and the role cannot
be saved even if nothing is changed.

The dialogs accept the same policy syntax that parseRBACPolicies and
formalizePoliciesList already handle, so label scoped roles can be created
and edited.

How to reproduce it:

Round tripping through the two helpers works fine:

"resources=application{env:prod};actions=get"
  -> parseRBACPolicies -> formalizePoliciesList
  -> "resources=application{env:prod};actions=get"

but the same string fails the form's validation schema:

yup.string().matches(POLICIES_STRING_REGEX).isValidSync(
  "resources=application{env:prod};actions=get"
) // false

In the UI: Settings > Project > Roles > Add Role, enter
resources=application{env:prod};actions=get, and the field shows
"Invalid policy format" so the submit button stays disabled.

[Goyamjain06]

Hi, I'd like to work on this — I'll update POLICIES_STRING_REGEX in web/src/constants/project.ts to accept the {key:value} label-block syntax that parseRBACPolicies/formalizePoliciesList already handle, so the Add/Edit Role dialogs stop rejecting label-scoped policies.