[Bug] Enabling Authorization only on Proxy

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Version

2.9.3

### Minimal reproduce step

I have the following (shortened) proxy.conf file :
```
zookeeperServers=pulsar-zookeeper
configurationStoreServers=pulsar-zookeeper
brokerServiceURL=
brokerServiceURLTLS=
brokerWebServiceURL=
brokerWebServiceURLTLS=
functionWorkerWebServiceURL=
functionWorkerWebServiceURLTLS=
zookeeperSessionTimeoutMs=30000
zooKeeperCacheExpirySeconds=300
bindAddress=0.0.0.0
haProxyProtocolEnabled=false
servicePort=6650
servicePortTls=6651
webServicePort=80
webServicePortTls=443

authorizationEnabled=true
authorizationProvider=com.saygin.pulsar.auth.SayginAuthorizationProvider
forwardAuthorizationCredentials=false

authenticationEnabled=true
authenticationProviders=org.apache.pulsar.broker.authentication.AuthenticationProviderToken

brokerClientAuthenticationPlugin=
brokerClientAuthenticationParameters=
brokerClientTrustCertsFilePath=/pulsar/certs/ca/ca.crt
tlsEnabledWithBroker=true
tlsCertRefreshCheckDurationSec=300

tlsEnabledInProxy=true
tlsCertificateFilePath=/pulsar/certs/proxy/tls.crt
tlsKeyFilePath=/pulsar/certs/proxy/tls.key
tlsTrustCertsFilePath=/pulsar/certs/ca/ca.crt

tlsAllowInsecureConnection=false
tlsHostnameVerificationEnabled=false
tlsRequireTrustedClientCertOnConnect=false

tokenSecretKey=file:///pulsar/auth/jwt/proxy-private.key

### --- Deprecated config variables --- ###

# Deprecated. Use configurationStoreServers
globalZookeeperServers=
configurationMetadataStoreUrl=pulsar-zookeeper:2184
metadataStoreUrl=pulsar-zookeeper:2181
```

### What did you expect to see?

I have two roles granted permission to consume topicst in to separate namespaces
role-1 -> namespace-1
role2 -> namespace-2

I expect role-1 NOT to consume topics in namespace-2
I expect role-2 NOT to consume topics in namespace-1

### What did you see instead?

All roles can subscribe to any topics within any namespaces listed.

### Anything else?

I've set an example by my custom provider, but using PulsarAuthorizationProvider (by default) also produces the same behavior. I only extended that class and added some logs inside, to see if it actually comes in any of the authorization methods.

I did NOT set brokerServiceURL or brokerServiceURLTLS on purpose, because I've read on [one of the issues](https://github.com/apache/pulsar/issues/7385) that enabling those automatically disables authorization Proxy. So instead I've set zookeeper discovery, which has been done successfully.

I don't want to change broker configuration, and I'm aware that skipping authentication / authorization between proxy and broker is a security leak, yet I'm fine with that.

What am I missing? How should I enable authorization only on proxy ?
Note : Authentication works perfectly without any problem on proxy side.

Note2 : I've set all even though it says deprecated for some configs, they seem to be necessary.
zookeeperServers=pulsar-zookeeper
configurationStoreServers=pulsar-zookeeper
configurationMetadataStoreUrl=pulsar-zookeeper:2184
metadataStoreUrl=pulsar-zookeeper:2181

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Begin with the shortened proxy.conf configuration and the authorization methods exercised by the custom provider. Reproduce the role-1 and role-2 namespace permission case, then determine whether proxy-only authorization is supported; done means the configuration or confirmed behavior prevents each role from consuming in the other namespace.

Written by the indexing model from the issue text.