fix: add authorization checks to Studio OAuth service endpoints

[adilburaksen]

Summary

OAuthHandler exposes three endpoints for managing OAuth providers and credentials
under the Studio data-pipeline service:

• GET /v1/oauth/provider/{provider}/credential/{credential} — returns an OAuth access token
• PUT /v1/oauth/provider/{provider}/credential/{credential} — stores credentials
• PUT /v1/oauth/provider/{provider} — stores a provider config

Unlike the adjacent ConnectionHandler, which calls ContextAccessEnforcer on every
operation, OAuthHandler performed no authorization checks. Any authenticated user
(or an unauthenticated request if the namespace is world-readable) could read back
OAuth access tokens stored by other users.

Fix

Initialize ContextAccessEnforcer from context.getContextAccessEnforcer() in
initialize(), then call enforceOnParent(EntityType.SYSTEM_APP_ENTITY, NamespaceId.SYSTEM, StandardPermission.GET/CREATE) at the entry point of each
handler method, following the pattern already established in ConnectionHandler.java.

Testing

Existing OAuthHandlerTest exercises the happy path. Authorization rejection is
covered by the enforcer's own unit tests; the pattern mirrors the already-tested
ConnectionHandler usage.

[gemini-code-assist]

Code Review

This pull request introduces authorization checks in OAuthHandler by integrating ContextAccessEnforcer into several endpoints. However, the current implementation will fail to compile because the checked AccessException is neither imported nor handled with try-catch blocks. Additionally, the use of StandardPermission.GET in getOAuthCredential violates the API contract for parent-level enforcement, and several other endpoints in the handler are still missing necessary authorization checks.

[adilburaksen]

Addressed all review feedback in the follow-up commit e250ec981cc:

StandardPermission.GET → LIST in getOAuthCredential: Correct — GET has isCheckedOnParent()=false in StandardPermission, so auth backends that check this flag (e.g. third-party AccessController plugins) would silently skip the enforcement. Changed to LIST which has isCheckedOnParent()=true and is the established pattern for read-on-parent checks (matches ConnectionHandler.listConnections).

AccessException try-catch: Not needed — AccessException extends RuntimeException (unchecked). The DefaultContextAccessEnforcer signature declares throws AccessException but since it's a RuntimeException the compiler does not require a catch or declaration at the call site. ConnectionHandler does the same.

Three uncovered endpoints: Added LIST to getAuthURL and getOAuthCredentialValidity, and CREATE to deleteOAuthProvider. All six handler methods now call enforceOnParent before any store operation.