fix(plugin-security): the packaged-permission-set lock refusal carries its guidance as userMessage

fix(plugin-security): the packaged-permission-set lock refusal carries its guidance as userMessage #42551