[fix][broker] Check topic permissions for partitions and subscriptions added to a transaction - #26644

Motivation

CommandAddPartitionToTxn and CommandAddSubscriptionToTxn only checked that the client owns the
transaction. The partitions and subscriptions added to it were not checked against the client's topic
permissions, unlike producing to a partition or subscribing.

Modifications

• AddPartitionToTxn requires PRODUCE on each partition.
• AddSubscriptionToTxn requires CONSUME on each topic, with the subscription name passed to the
  provider (AuthenticationDataSubscription), as subscribe does.
• One refused participant fails the request with AuthorizationError, through the new
  BrokerServiceException.NotAuthorizedException. The scalable-topic path does not register
  participants and is unchanged.
• The message returned to a client that does not own the transaction goes through the role logging
  anonymizer.

This PR and #26643 both add BrokerServiceException.NotAuthorizedException; whichever is merged second
will merge master.

Verifying this change

• Make sure that the change passes the CI checks.

This change added tests and can be verified as follows:

• ServerCnxTest: partitions and subscriptions refused without the permission (nothing is
  registered with the coordinator), including a request where only one of two partitions is refused;
  the existing sendAddPartitionToTxnResponse* and sendAddSubscriptionToTxnResponse* tests cover
  the allowed path.

Does this pull request potentially affect one of the following parts:

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

The binary protocol messages are unchanged; the broker now answers AuthorizationError to these
commands when the client lacks the permission.

🤖 Generated with Claude Code