`accessSecurityScopedResource`'s `onFailure` conflates "denied" with "didn't need a scope"

`startAccessingSecurityScopedResource()` returns `false` both when access is denied *and* when the URL doesn't require a scope (app-container files, children enumerated under an active parent scope). The wrapper routes both to `onFailure`, documented as "Called if the request to access the resource at this URL failed."

`MediaItem` learned this the hard way and now treats the boolean as ownership rather than success. This helper still encodes the older assumption, and every future caller inherits it.

Locate the accessSecurityScopedResource helper and inspect how its onFailure callback is documented and invoked. Read the MediaItem handling mentioned in the issue for comparison. Done means the helper no longer makes callers treat a false return as unambiguously denied, with its behavior and callback semantics made consistent.

Written by the indexing model from the issue text.