Add explicit RBAC permissions to OAuth registered-client management (#6109)