Fix the authorization table for org roles

An agent built your app's authorization middleware from a one-paragraph spec: admins can edit any org, members can edit only their own org, viewers are read only. The demo works, but demos only show what is allowed. So you write the spec out as a full table, including the cases it implies, and check every cell.

An assistant wrote authorization_matrix(roles, actions, same_org_flags), which decides each cell. It is in the editor. It has a bug. Find it and fix it.

Input and output:

• roles, actions, same_org_flags: one request per position: the caller's role, the action, and whether the resource belongs to the caller's own org.
• Return one true (allow) or false (deny) per entry of roles, in order.

Rules the tests check:

• If actions or same_org_flags has no entry at a position, deny that request.
• Compare roles and actions with whitespace trimmed from both ends, ignoring case.
• Only the actions read and edit can ever be allowed. Any other action, an empty one included, is denied.
• admin: may read and edit in any org.
• member: may read and edit only in their own org.
• viewer: may read only, and only in their own org.
• Any other role, an empty one included, is denied.