[Bug] Authorization is broken for endpoints which access any resource other than a table

While trying [Authentication and Authorisation feature of Pinot](https://docs.pinot.apache.org/operators/tutorials/authentication), I found that for controller, any endpoint which accesses a non-table resource, authorisation does not work as expected using either of the bundled auth options:

1. BasicAuthAccessControlFactory
2. ZkBasicAuthAccessControlFactory

I would consider this a CRITICAL security flaw as it gives a normal user power to do any sort of destructive action in the cluster.

Consider a simple example.

---
Assume we have 3 users in system:

1. admin
3. test
4. user1


---

Now we try to DELETE _user1_ who is an admin by submitting a request as _test_ who is a normal user


Voila _user1_ is deleted! :(

---

But the user _test_ was not authorised to do so !!


---

This example is just tip of the iceberg. I plan to work to fix this once the team confirms this is really broken.

Start with the controller endpoints that access non-table resources and the BasicAuthAccessControlFactory and ZkBasicAuthAccessControlFactory paths, using the linked authentication and authorization tutorial to reproduce the DELETE request as a normal user. Done means unauthorized users can no longer perform destructive actions on non-table resources, with coverage for both bundled authorization options.

Written by the indexing model from the issue text.