[server] Add authorization to Snapshot Management RPCs (commitKvSnapshot, notifyKvSnapshotOffset, commitLakeTableSnapshot, notifyLakeTableOffset)

### Search before asking

- [x] I searched in the [issues](https://github.com/apache/fluss/issues) and found nothing similar.

### Motivation

**Part of umbrella issue #2007 - Phase 2: Internal RPCs**

Add authorization checks for snapshot management operations:
- `commitKvSnapshot` - CLUSTER/WRITE
- `notifyKvSnapshotOffset` - CLUSTER/WRITE
- `commitLakeTableSnapshot` - CLUSTER/WRITE
- `notifyLakeTableOffset` - CLUSTER/WRITE

These are **internal server-to-server RPCs** that need both:
1. Authorization checks for CLUSTER/WRITE operations
2. Validation that `session.isInternal()` is true to prevent external clients from
calling internal APIs

### Solution

_No response_

### Anything else?

_No response_

### Willingness to contribute

- [x] I'm willing to submit a PR!

Locate the server entry points for commitKvSnapshot, notifyKvSnapshotOffset, commitLakeTableSnapshot, and notifyLakeTableOffset, then read the existing authorization handling around comparable internal RPCs. Done means all four operations enforce CLUSTER/WRITE authorization and reject sessions where session.isInternal() is false.

Written by the indexing model from the issue text.