Gate the dashboard API by the permission of the data each section shows #8561

Problem

Every dashboard endpoint requires the single dashboard:view permission:

• GET /dashboard/overview
• /dashboard/workflow-trends
• /dashboard/recent-activity
• /dashboard/needs-attention
• /dashboard/workflow-hotspots

Elsa Studio is making the Dashboard reachable by every signed-in user, with each widget gated by the permission of the data it shows (elsa-workflows/elsa-studio#1099). The design decisions are recorded on that issue. For that gating to be real and not cosmetic, the API has to apply the same rule.

Change

Keep dashboard:view as the permission for the whole operational overview, so existing roles keep working. Also accept the permission of the data a section shows:

• overview requires an authenticated caller (anonymous callers still get 401). A section the caller may not read is returned with Capability = Unauthorized and no data, using the existing DashboardCapabilityStatus.Unauthorized. The overview therefore never leaks data, and never refuses a user who can read part of it.
  • Metric cards and panels that summarise a section follow that section's permission.
  • Contributions from other modules declare the permission of the data they add, so the same filtering applies to them.
• The single-purpose endpoints answer 403 unless the caller holds dashboard:view or workflows/instances:view.
• RequirePermission has no "any of" form. Check permissions in the handler with the evaluator, using HttpContext.GetPermissionEvaluator() from fix(authorization): let a definition viewer open the designer #8556. When EndpointSecurityOptions.SecurityIsEnabled is false, allow everything, as RequirePermission does.
• Update the dashboard permission description, and document the change in doc/migrations/authorization-model.md.

Acceptance criteria

• A caller with only workflows/instances:view gets the instance metrics, trends, recent activity, needs-attention and hotspots.
• The same caller gets the runtime and diagnostics sections of the overview marked Unauthorized, with no data.
• A caller with only diagnostics/structured-logs:view gets that summary and every other overview section marked Unauthorized. The single-purpose endpoints refuse them with 403.
• dashboard:view alone still returns everything, as today.
• Anonymous callers get 401 on every dashboard endpoint.
• Tests follow InstalledFeaturesAuthorizationTests and DescriptorCatalogAuthorizationTests.