[security] Restrict plugin upload endpoint to admin role (#4149)

[Bhavya-Sonigra]

Fixes #4149

What's changed?

The /api/plugin endpoint had no role-based access control in sureness.yml, unlike every other API path in the file. Since plugin upload loads custom JAR code into the JVM via ServiceLoader, this meant any authenticated (or in some cases unauthenticated) user could manage plugins with the same access as an admin.

This PR adds explicit admin-only role mappings for /api/plugin/**, following the exact pattern used elsewhere in the file:

• /api/plugin/**===get===[admin]
• /api/plugin/**===post===[admin]
• /api/plugin/**===put===[admin]
• /api/plugin/**===delete===[admin]

Tested locally:

• Request to /api/plugin with no auth token → 401 Unauthorized
• Request to /api/plugin with an admin token → 200 OK with expected data

Checklist

• I have read the Contributing Guide
• I have written the necessary doc or comment.
• I have added the necessary unit tests and all cases have passed.

[Bhavya-Sonigra]

Hi! Just following up on this PR. I've resolved the merge conflicts and updated the branch with the latest master. Whenever someone has time, I'd really appreciate a review. Thank you!