[Subtask] Wire X-Gravitino-Active-Roles into the request path with validation

[bharos]

Describe the subtask

Parse the X-Gravitino-Active-Roles header on each request and make the declared active roles available to the authorization path, so role narrowing takes effect. Validate the header value:

• Malformed value → 400 Bad Request.
• Well-formed value naming a role the caller does not hold → 403 Forbidden.

An absent header behaves as ALL (no narrowing), preserving current behavior.

Parent issue

#11965