MANGO-2945 Add a script that finds EMS dangling references

[MertCingoz]

Description

• https://radixiot.atlassian.net/browse/MANGO-2945
• Adds ems-dangling-references.js, a script that reports references to things that no longer
  exist in the Platform Manager (EMS) JSON stores, and removes the dangling role xids.
• This cleans up existing configurations only — it is not a product fix, so new ghost xids can
  still appear.

Current behavior

Deleting a role does not remove its xid from the EMS stores, and the editors cannot remove an xid
that no longer resolves to a role, so it stays visible in the Site, Device, Device Type and
General Overview cards forever. Other broken pointers in those stores (a device pointing at a
deleted site, a tab naming a deleted watch list) are just as invisible.

Expected behavior

One run reports every dangling reference, each addressed by store xid plus a JSON pointer. With
dryRun = false the dangling role xids are removed; that grants and revokes nothing, since a role
xid that does not resolve is already dropped when the permission is evaluated
(EmsService#hasPermission). Everything else is reported only — the right repair there is a
judgement call per entity.

Changes

New file ems-dangling-references.js, with dryRun (default true) and auditOtherReferences
(default true) at the top.

• Part 1, deleted roles: treats every readPermissions / <name>ReadPermissions array as role
  xids, so card locations added later are covered. Writes are one re-read-then-write per array, so
  a concurrent Platform Manager edit is skipped rather than clobbered, and each is audited. Arrays
  pruned to nothing are flagged — they become superadmin-only, which they already were in practice.
• Part 2, reported only: entity key vs. embedded xid, Device.siteXid, Device.deviceTypeXid,
  DeviceType.sites[], site columns whose deviceID matches no device, and WATCHLIST /
  DASHBOARD tabs naming a missing watch list or page.
• Data point references are out of scope — they are matched by name and tag per device, so
  "missing" is not a fact there and wants its own report.

Resources

Report shape (dry run):

PART 1 - DELETED ROLE REFERENCES (removed by this script)

[ems-sites]
  site-1
    /site-1/readPermissions                    remove: old-operators

  arrays to change: 4   references to remove: 6   arrays left empty: 1

PART 2 - OTHER DANGLING REFERENCES (reported only, nothing is changed)

  [device -> site]
    ems-devices /dev-9/siteXid                 'site-old' - no such site

Tests

Run against Mango 5.7.5 with roles deleted out from under the EMS stores: the dry run matches the
xids the cards show as unremovable, dryRun = false clears them, and a re-run finds nothing left.
Take a configuration export with "JSON Data" selected before turning dryRun off.

Checklist

• Release notes were added to the ticket
• QA was done