fn permission_metadata_matches( configured: &str, expression: &PermissionMetadataExpression, ) -> bool