Context:
Once OPT-2549 is implemented we want to consider cleaning up collection permission entries of deleted users/groups.

AT:

• deleted users/groups are detected and cleaned from collection permissions (the role entry is deleted)
• the permission cleanup is triggered after a successfully finished identity synchronization run
• there is an info log issued for each cleaned up entry (for transparency)
• no new identity synchronization is run until the permission cleanup is finished (one cleanup run should be based on one consistent cache state)