Restrict the entitlements allowed by the contract update validator

[SupunS]

Currently this allows any set of entitlements with equal or less access permitted than the "actual" access granted by the migration. E.g. if some reference &T will be given auth(E, F) by the migration, users can update that type in a field to any of &T, auth(E) &T, auth(F) &T, auth(E | F) &T or auth(E, F) &T.

s this okay, or should we be more restrictive and require that users only migrate their field types to exactly what the migration will grant?

Originally posted by @dsainati1 in #3069 (comment)

[SupunS]

IMO we should restrict the update checker to allow field types to be exactly what the entitlement migration will grant

[turbolent]

Is it a problem if they choose a less permissive variant?