[Bug] Session id / operation id are not isolated by share level.

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

### Search before asking

- [X] I have searched in the [issues](https://github.com/apache/kyuubi/issues?q=is%3Aissue) and found no similar issues.

### Describe the bug

In USER level and GROUP level anyone can access to other users' / groups' Session and Operation as long as they have the session id or operation id. This breaks the share level isolation and may cause resource leak.

### Affects Version(s)

master

### Kyuubi Server Log Output

_No response_

### Kyuubi Engine Log Output

_No response_

### Kyuubi Server Configurations

```yaml
Disable authentication and authorization.
```

### Kyuubi Engine Configurations

_No response_

### Additional context

_No response_

### Are you willing to submit PR?

- [ ] Yes. I would be willing to submit a PR with guidance from the Kyuubi community to fix.
- [X] No. I cannot submit a PR at this time.

Start by reproducing the reported access to another user's or group's Session and Operation at USER and GROUP share levels with authentication and authorization disabled. Trace how session and operation IDs are resolved, then verify that cross-share access is denied and cannot cause the reported resource leak.

Written by the indexing model from the issue text.