[server] Add authorization to Replication Control RPCs (notifyLeaderAndIsr, updateMetadata, stopReplica, adjustIsr)

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Motivation

**Part of umbrella issue #2007 - Phase 2: Internal RPCs**

Add authorization checks for replication control operations:
- `notifyLeaderAndIsr` - CLUSTER/WRITE
- `updateMetadata` - CLUSTER/WRITE
- `stopReplica` - CLUSTER/WRITE
- `adjustIsr` - CLUSTER/WRITE

These are **internal server-to-server RPCs** that need both:
1. Authorization checks for CLUSTER/WRITE operations
2. Validation that `session.isInternal()` is true to prevent external clients from
calling internal APIs

### Solution

_No response_

### Anything else?

_No response_

### Willingness to contribute

- [x] I'm willing to submit a PR!

Locate the server handlers for notifyLeaderAndIsr, updateMetadata, stopReplica, and adjustIsr, then inspect existing authorization checks and session.isInternal() validation. Done means all four RPCs enforce CLUSTER/WRITE authorization and reject sessions that are not internal.

Written by the indexing model from the issue text.