fix: merging permissions objects will discard ordering. instead, preserve permissions objects as layers, convert them individually to rulesets, and merge the rulesets (#16157)