[Bug] topic auto creation does not check for CREATE_TOPIC permission

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Version

2.10

### Minimal reproduction step

Subscribe to an unexisting topic using CONSUME permission but without CREATE_TOPIC permission.

### What did you expect to see?

Authorization error as CREATE_TOPIC is not authorized.

### What did you see instead?

Consumer created and consuming.

### Are you willing to submit a PR?

- [X] I'm willing to submit a PR!