Fix completed reply listing for non-admin users with large reply volumes

Non-admin users cannot open or view completed form replies when a form has a large number of replies. The management portal already requests replies in pages, but the API previously attempted to authorize every matching reply resource in a single Keycloak UMA request before applying pagination.

With thousands of replies, this bulk authorization request can fail on the production Keycloak 20.0.5 deployment. System administrators are unaffected because their reply listing bypasses this per-reply authorization path.

This fix:

• Replaces the bulk Keycloak resource authorization call in reply listing with a local permission evaluation based on stored reply field values and the user’s Keycloak group memberships.
• Preserves the existing Total-Results count and response pagination behavior.
• Allows users in either a reply’s viewGroupIds or editGroupIds to list replies.
• Allows a user with reply:edit permission to open a reply when no separate reply:view permission exists, matching the management portal’s edit-only group configuration.
• Does not require a Keycloak upgrade and is compatible with Keycloak 20.0.5.

Acceptance Criteria

A non-admin user with the appropriate member group can list and open completed replies.
Reply listing works when there are thousands of matching replies.
The API returns only the requested page of replies while preserving the correct total result count.
An edit-only member group can list and open replies.
System administrator behavior remains unchanged.

Start at the API's completed-reply listing and authorization path described in the issue, then inspect how reply field values and Keycloak group memberships are stored and evaluated. Verify paginated responses retain the correct Total-Results count, non-admin users can list and open replies through view or edit groups, and administrator behavior remains unchanged.