### Apache Airflow version

2.6.3

### What happened

Versions: 2.6.2, 2.6.3, main

PR [#30340](https://github.com/apache/airflow/pull/30340) introduced a bug that happens whenever a DAG gets updated or a new DAG is added

**Potential fix:** Adding the code that was removed in PR [#30340](https://github.com/apache/airflow/pull/30340) back to `airflow/models/dagbag.py` fixes the issue. I've tried it on the current main branch using Breeze.


### What you think should happen instead

Permissions set in Web UI stay whenever a DAG sync happens

### How to reproduce

1. Download `docker-compose.yaml`:
```bash
curl -LfO 'https://airflow.apache.org/docs/apache-airflow/2.6.2/docker-compose.yaml'
```
2. Create dirs and set the right Airflow user:
```bash
mkdir -p ./dags ./logs ./plugins ./config && \
echo -e "AIRFLOW_UID=$(id -u)" > .env
```
4. Add `test_dag.py` to ./dags:
```python
import datetime

import pendulum

from airflow import DAG
from airflow.operators.bash import BashOperator

with DAG(
    dag_id="test",
    schedule="0 0 * * *",
    start_date=pendulum.datetime(2021, 1, 1, tz="UTC"),
    catchup=False,
    dagrun_timeout=datetime.timedelta(minutes=60),
) as dag:
    test = BashOperator(
        task_id="test",
        bash_command="echo 1",
    )
if __name__ == "__main__":
    dag.test()
```
5. Run docker compose: `docker compose up`
6. Create role in Web UI: Security > List Roles > Add a new record:
	Name: test
	Permissions: `can read on DAG:test`
7. Update `test_dag.py`: change `bash_command="echo 1"` to `bash_command="echo 2"`
8. Check test role's permissions: `can read on DAG:test` will be removed

Another option is to add a new dag instead of changing the existing one:
6. Add another dag to ./dags, code doesn't matter
7. Restart scheduler: `docker restart [scheduler container name]`
9. Check test role's permissions: `can read on DAG:test` will be removed

### Operating System

Ubuntu 22.04.1 LTS

### Versions of Apache Airflow Providers

_No response_

### Deployment

Docker-Compose

### Deployment details

Docker 24.0.2

### Anything else

_No response_

### Are you willing to submit PR?

- [X] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

"""
        Add missing permissions to the table for admin.
        Admin should get all the permissions, except the dag permissions
        because Admin already has Dags permission.
        Add the missing ones to the table for admin.
        :return: None.
        """
        session = self.appbuilder.get_session
        dag_resources = session.scalars(
            select(Resource).where(Resource.name.like(f"{permissions.RESOURCE_DAG_PREFIX}%"))
        )
        resource_ids = [resource.id for resource in dag_resources]
        perms = session.scalars(select(Permission).where(~Permission.resource_id.in_(resource_ids)))
        perms = [p for p in perms if p.action and p.resource]
        admin = self.find_role("Admin")
        admin.permissions = list(set(admin.permissions) | set(perms))
        session.commit()
    def sync_roles(self) -> None: