### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

In an Entra environment using access packages, it's possible to have multiple app roles passed as part of the SSO payload. Rather than picking the highest possible permission level, currently LiteLLM just picks the first value in that array. This is handled in https://github.com/BerriAI/litellm/blob/5d25e75f3b3c8d4c01418f731c42ae31478b841c/litellm/proxy/management_endpoints/ui_sso.py#L3845

The expected behavior would be that it selects the highest level in the role list.

### Steps to Reproduce

1. Configure entra to have multiple roles assigned for a given user 2. Login via SSO 3. Assigned role is the first one in the array, not the most permissive

### Relevant log output

```shell

```

### What part of LiteLLM is this about?

UI Dashboard

### What LiteLLM version are you on ?

v1.92.0

### Twitter / LinkedIn details

_No response_