Ensure that the system parachains can accept XCM calls (`authorize_upgrade`) from the AssetHub and/or Collectives governance systems.

[bkontur]

Relates to: #7541
Relates to: #5588 (comment)

Description

As we move the governance system from the relay chain to AssetHub, we must ensure that we can still upgrade the system parachains with xcm::Transact(authorize_upgrade(new_code_hash)) after the AHM migration.

1. Ensure XCM configuration:

• unpaid execution for governance systems on SPs
• waived locations for governance systems on SPs
• Accept RuntimeOrigin::root as AssetHub/Collectives for runtime upgrades - check similar Ensure that the relay chain can accept authorize_upgrade from the AssetHub and/or Collectives governance systems. #7541 (comment)

2. Ensure AssetHub can upgrade itself
(I guess it should work by default)

TODO

• add runtime tests to verify XCM origin conversion works as expected
• add tests to ensure system parachain can accept authorize_upgrade from AH/Collectives governance systema
• create tracking issue for polkadot-fellows

[bkontur]

@karolk91 when you have time, it would be cool to port fn governance_authorize_upgrade_works tests to the fellows on the main branch, there were pretty useful for #8399