feat(standards): add grant delays to RBAC

[onurinanc]

Summary

• Record active_since = now + grant_delay on every grant and make has_role require that timestamp to have passed, so a pending grant can be revoked before the member can act.
• Add set_grant_delay / get_grant_delay, with the setter restricted to ADMIN so a delegated admin cannot shorten the delay its grants are subject to.
• Cap the transaction's expiration delta on delayed grants so an old reference block cannot shorten the delay, and keep re-granting a pending member a no-op.
• Add RoleConfig::with_grant_delay and tests covering activation, the pending-only delegated admin lockout, revocation, and the ADMIN-only setter.

Closes #3866.