security: add authorization checks to WorkflowHttpHandler

[adilburaksen]

The workflow run endpoints under /v3/namespaces/{namespace-id}/apps/{app-id}/workflows/{workflow-id}/runs/{run-id} accessed workflow run data and workflow run state using only the namespace, application and workflow names from the request path, without enforcing any access control on the selected workflow program.

This change injects ContextAccessEnforcer into the handler and enforces access on the workflow ProgramReference before each operation:

• Read endpoints (workflow token, node-level token, node states, local datasets) enforce StandardPermission.GET.
• State-changing endpoints (suspend, resume, delete local datasets) enforce StandardPermission.UPDATE.

This mirrors the program-level enforcement already performed by the sibling program runtime handler and the other authorization PRs in this area. Hardening only; no functional change for authorized callers.

[gemini-code-assist]

Code Review

This pull request integrates authorization checks into WorkflowHttpHandler by injecting ContextAccessEnforcer and enforcing permissions (UPDATE or GET) across various workflow endpoints. However, a critical compilation issue was identified: the contextAccessEnforcer.enforce method throws a checked exception (AccessException), but enforceWorkflowAccess and several calling endpoints do not declare or handle this exception, which will prevent the code from compiling.

[gemini-code-assist]

The contextAccessEnforcer.enforce method throws AccessException, which is a checked exception. However, enforceWorkflowAccess does not declare throws AccessException (or throws Exception) or catch it, which will cause a compilation error.

To resolve this, enforceWorkflowAccess should be updated to declare throws Exception (or throws AccessException). Additionally, all calling endpoint methods that do not already declare throws Exception (such as getWorkflowToken, getWorkflowNodeStates, getWorkflowLocalDatasets, and deleteWorkflowLocalDatasets) must also be updated to declare throws Exception in their method signatures to propagate the exception correctly.

Suggested change

	private void enforceWorkflowAccess(String namespaceId, String appId, String workflowId,
	StandardPermission permission) {
	ProgramReference programReference = Ids.namespace(namespaceId).appReference(appId)
	.program(ProgramType.WORKFLOW, workflowId);
	contextAccessEnforcer.enforce(programReference, permission);
	}
	private void enforceWorkflowAccess(String namespaceId, String appId, String workflowId,
	StandardPermission permission) throws Exception {
	ProgramReference programReference = Ids.namespace(namespaceId).appReference(appId)
	.program(ProgramType.WORKFLOW, workflowId);
	contextAccessEnforcer.enforce(programReference, permission);
	}