fix(FOUR-33067): Regression octane>> User created by SSO are created as superadmin users

[rodriquelca]

Issue & Reproduction Steps

On Octane, the navigation menu keeps state between requests. A user can see Admin/Designer options from a previous session, even without permissions. The menu can also repeat items on each page load.
Repro:

1. Log in as superadmin → open /inbox or /tasks
2. Log out
3. Log in as SSO user (no admin permissions)
4. Bug: Admin/Designer still appear in the topnav (or menu items duplicate)

Solution

Removed MenuManager from Octane warm

• Added MenuManager::reset() to clear menu builders between requests
• ResetRequestState now resets the menu at the end of each request
• Unit test added for menu leak

How to Test

• Restart Octane
• Login superadmin → load /inbox → logout
• Login SSO user (no admin perms)
• Confirm Admin/Designer are hidden and menu is not duplicated

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-33067

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

[cursor]

PR Summary

Medium Risk
Touches per-request Octane lifecycle and navigation visibility; wrong reset timing could affect menu rendering, but scope is isolated to menu state cleanup.

Overview
Fixes Octane menu state leaking between requests so a later user (e.g. SSO without admin rights) no longer sees Admin/Designer entries or duplicated items from a prior superadmin session.

Adds MenuManager::reset() to clear internal menu builders and collections, and invokes it from ResetRequestState on each request teardown (alongside existing redirect/timing resets). MenuManager (and ScreenBuilderManager) are removed from Octane’s warm list so workers do not keep a long-lived menu instance that accumulates per-user items.

A unit test simulates admin menu generation, runs the Octane reset, then generates menus for a non-admin and asserts admin nav items are absent.

^{Reviewed by Cursor Bugbot for commit c9a7fc1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube