bug: fix CalculateRightKeys based on instance delegation policy (#2609)

#2608

Co-authored-by: Jon Kjetil Øye <acn-joye@ai-dev.no>

Author: jonkjetiloye

src/apps/Altinn.AccessManagement/src/Altinn.AccessMgmt.Core/Utils/Helper/DelegationCheckHelper.cs

@@ -183,6 +183,7 @@ public static IEnumerable<string> CalculateRightKeys(XacmlRule rule, string reso
             {
                 var org = resourceObj.FirstOrDefault(r => r.Id.Equals(AltinnXacmlConstants.MatchAttributeIdentifiers.OrgAttribute));
                 var app = resourceObj.FirstOrDefault(r => r.Id.Equals(AltinnXacmlConstants.MatchAttributeIdentifiers.AppAttribute));
+                var instance = resourceObj.FirstOrDefault(r => r.Id.Equals(AltinnXacmlConstants.MatchAttributeIdentifiers.ResourceInstanceAttribute));
 
                 if (org != null && app != null)
                 {
@@ -192,6 +193,11 @@ public static IEnumerable<string> CalculateRightKeys(XacmlRule rule, string reso
                     resourceObj.Add(new PolicyAttributeMatch { Id = AltinnXacmlConstants.MatchAttributeIdentifiers.ResourceRegistryAttribute, Value = resourceAppId });
                 }
 
+                if (instance != null)
+                {
+                    resourceObj.Remove(instance);
+                }
+
                 // Just throw away resources not matching the resourceid we are looking for
                 if (resourceObj.Any(r => r.Id.Equals(AltinnXacmlConstants.MatchAttributeIdentifiers.ResourceRegistryAttribute) && r.Value.Equals(resource, StringComparison.OrdinalIgnoreCase)) == false)
                 {