permission's location

Both.

Each file and folder on the disk stores information about the user ownership and group ownership and about what the owner, members of the group, and others are allowed to do to that file. Read, Write, Execute.

The information of the user password, the user names and group names is stored on the SD card. What groups a user belongs to, and so on. And a mapping between the user name as text to the User ID as a number, same with the group name and the Group ID. It is the UID and GID that is stored with each file, not the actual name.

This can mess things up. If you move a HDD from one computer to another, the UID and GID for files and folders may map to other users and groups. This depends on what users and groups was created on each system and in what order.

As long as the current users are still able to login, and you use the same server, chances are good that all this didn't change at all during the upgrade.

But even if it stopped working, you should still be fine. All you would have to do was to roll back the backups, and you would be back to the old OMV 4 in perfect condition. I assume, naturally, that you ensured that you at least one good, tested and current backups of all data and a current clone of the rootfs before you upgraded?