feat(mail): enforce owned profile self-service

tests/test_manifest.py

@@ -40,6 +40,21 @@ class MailManifestTests(unittest.TestCase):
                 for interface in manifest.provides_interfaces
             ],
         )
+        permissions = {permission.scope for permission in manifest.permissions}
+        self.assertIn("mail:profile:write_own", permissions)
+        self.assertIn("mail:secret:manage_own", permissions)
+        roles = {template.slug: template for template in manifest.role_templates}
+        self.assertEqual(
+            set(roles["mail_profile_self_service"].permissions),
+            {
+                "mail:profile:read",
+                "mail:profile:use",
+                "mail:profile:test",
+                "mail:mailbox:read",
+                "mail:profile:write_own",
+                "mail:secret:manage_own",
+            },
+        )
         topics = {topic.id: topic for topic in manifest.documentation}
         self.assertTrue(
             {