[fix][broker] Check topic permissions for binary GetSchema and GetOrCreateSchema - #26643

Motivation

The REST schema endpoints check topic permissions (GET_METADATA to read, PRODUCE to upload in
SchemasResourceBase), but the binary CommandGetSchema and CommandGetOrCreateSchema handlers in
ServerCnx did not check any permission.

Modifications

• CommandGetSchema requires LOOKUP on the topic. Producers, consumers and readers already hold it,
  since they look the topic up first; the default provider treats LOOKUP and GET_METADATA alike.
• CommandGetOrCreateSchema requires PRODUCE on the topic, like the REST schema upload.
• A refused request gets AuthorizationError, through the new
  BrokerServiceException.NotAuthorizedException mapped in getClientErrorCode.
• ClientChannelHelper now decodes the two schema responses for tests.

This PR and #26644 both add BrokerServiceException.NotAuthorizedException; whichever is merged second
will merge master.

Verifying this change

• Make sure that the change passes the CI checks.

This change added tests and can be verified as follows:

• ServerCnxTest: each command refused without the permission (the schema registry or the topic is
  never reached) and allowed with it.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

The binary protocol messages are unchanged; the broker now answers AuthorizationError to these
commands when the client lacks the permission.

🤖 Generated with Claude Code