The capabilities 'mod/lti:addmanualinstance' and 'mod/lti:addpreconfiguredinstance' were added in MDL-62815, but I think a bug slipped through there unnoticed.

In that issue:
a) There was a comment from Eloy essentially noting that the USE of preconfigured tools (whether site or course) was supposed to be controlled by 'mod/lti:addpreconfiguredinstance'. https://tracker.moodle.org/browse/MDL-62815?focusedCommentId=662714&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-662714
b) The manual testing didn't cover the case where there was a preconfigured COURSE tool. It only tested with preconfigured SITE tools.
c) Subsequently, the part of the testing that covered the 'mod/lti:addmanualinstance' capability failed to see what I think is a bug in the 'lti_get_lti_types_by_course()' method.

The bug:
When the user ONLY has 'mod/lti:addmanualinstance' capability, they aren't supposed to see anything other than 'automatic, based on tool URL' in the preconfigured tool select (per the testing instructions). If there's a course tool present, however, they'll also see that. Given a course tool is supposed to be considered a 'preconfigured' tool (per Eloy's comment and per my understanding too), this entry should not be present when the user doesn't have permissions 'mod/lti:addpreconfiguredinstance'. I don't think the intention was to treat course tools as a special case. Certainly there's no testing covering that.

Furthermore, if the user were to select that course-level tool when creating the instance, subsequent edits would not permit the user to change it in any way. They'll see Tool URL and can then set that, overriding the course tool they were able to set when creating the instance.

To reproduce:

1. Login as the admin
2. Go to "Site admin > Plugins > Activities > External tool > Manage tools"
3. Click "Configure a tool manually"
4. Enter the name "Site tool" and enter the URL "https://moodle.org"
5. Save the tool
6. Create a course
7. Click to add an activity/resource, selecting "External tool" from the activity chooser
8. Next to the "Preconfigured tools" select, click the "+" icon to add a course tool
9. Name it "Course tool" and set the URL to "http://example.com"
10. Save changes and when the tab closes, just cancel out of the activity instance form (we don't need an instance, we just need the course tool to be created).
11. Enrol an editing teacher in the course
12. Go to "Participants > Permissions" and select the "Editing teacher" role from the "Advanced role override" select
13. filter using 'mod/lti' to make it easier to see the relevant caps
14. Set the following cap values:
    • "mod/lti:addmanualinstance" to "Inhert (Allow)"
    • "mod/lti:addpreconfiguredinstance" to "Prohibit"
15. Save the overrides.
16. Log out
17. Log in as the teacher
18. Go to the course
19. Click to add an activity/resource, selecting "External tool" from the activity chooser
20. Look at the options in the "Preconfigured tools" select:
    Expected: You only see the "Automatic, based on tool URL" option
    Actual: You see the above option as well as the "Course tool" course preconfigured tool.
21. Select "Course tool" and save
22. Edit the instance you just created
23. Note you cannot change the preconfigured tool now
24. Log out
25. Log in as the admin
26. Go to the course and edit the activity
27. Note that you do see the preconfigured tool listed as "Course tool" here.

Changing this code to match the expectations above (no preconfigured tools listed, whether they be course or site) won't break any existing phpunit or behat tests.