fix(plugin-security): the app default permission set resolves from the first level that NAMES one (#15298)

fix(plugin-security): the app default permission set resolves from the first level that NAMES one (#15298) #30432