API i/import-user-lists can bypass userListLimit role policy

[SWREI]

💡 Summary

User can create lists by importing their lists from other server. (can't bypass userEachUserListsLimit at all by importing is using same method)

🥰 Expected Behavior

User can't import their list due to role policy

🤬 Actual Behavior

User can import their list unlimited

📝 Steps to Reproduce

1. set userListLimit value to 0
2. import any list from other instance

💻 Frontend Environment

* Model and OS of the device(s): Windows 11 23H2 (22631.3737)
* Browser: Chrome 125.0.6422.176
* Server URL: oscar.surf (but not server related)
* Misskey: 2024.5.0-oscar.1a

🛰 Backend Environment (for server admin)

* Installation Method or Hosting Service: systemd
* Misskey: 2024.5.0-oscar.1a
* Node: 20.11.1
* PostgreSQL: 15.6-1.pgdg22.04+1
* Redis: 7.2.4
* OS and Architecture: Ubuntu 22.04.4 LTS aarch64

Do you want to address this bug yourself?

• Yes, I will patch the bug myself and send a pull request