Fix the role check on a delete user route

Your admin API has a route that deletes any user account. The spec says only callers with the admin role may use it. Login middleware has already verified the caller's token and passes in their roles.

An assistant wrote may_delete_user(authenticated, actor_roles, required_role, request_flags), which decides whether the delete goes ahead. It is in the editor. It has a bug. Find it and fix it.

Input and output:

• authenticated: true when the caller is logged in.
• actor_roles: the caller's roles, as strings.
• required_role: the role the route requires, read from config.
• request_flags: the query parameters on the URL, such as force=true or debug=1.
• Return true when the delete may go ahead, false otherwise.

Rules the tests check:

• A caller who is not authenticated gets false.
• Trim whitespace from both ends of required_role. If nothing is left, return false: a requirement nobody set denies everyone.
• Otherwise return true only when some role in actor_roles, trimmed at both ends, equals the trimmed required_role exactly. Case matters, so Admin is not admin, and superadmin is not admin either.
• request_flags never changes the answer.