[Bug] List Clusters API has no Authorization Check

### Search before reporting

- [x] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Read release policy

- [x] I understand that [unsupported versions](https://pulsar.apache.org/contribute/release-policy/#supported-versions) don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.

### User environment

Pulsar Version 4.1.3
Broker Java Version: 17
Client Library Version: 4.1.3

### Issue Description

The list-clusters API has no Authorization check, allowing any user to list all clusters. The ClusterOperations class, along with the Authorization Provider, does have the capability to forbid these operations, but as the authorization layer is never invoked by the getCluster function, shown below:
```java
@GET
@ApiOperation(
value = "Get the list of all the Pulsar clusters.",
response = String.class,
responseContainer = "Set")
@ApiResponses(value = {
@ApiResponse(code = 200, message = "Return a list of clusters."),
@ApiResponse(code = 500, message = "Internal server error.")
})
public void getClusters(@Suspended AsyncResponse asyncResponse) {
clusterResources().listAsync()
.thenApply(clusters -> clusters.stream()
// Remove "global" cluster from returned list
.filter(cluster -> !Constants.GLOBAL_CLUSTER.equals(cluster))
.collect(Collectors.toSet()))
.thenAccept(asyncResponse::resume)
.exceptionally(ex -> {
log.error("[{}] Failed to get clusters {}", clientAppId(), ex);
resumeAsyncResponseExceptionally(asyncResponse, ex);
return null;
});
}
```

All users are allowed to get clusters.

### Error messages

```text

```

### Reproducing the issue

1. Start a pulsar standalone cluster with Authentication and Authorization.
2. Call the cluster-list API with a trusted client, that has no authorizations on the platform.

### Additional information

_No response_

### Are you willing to submit a PR?

- [x] I'm willing to submit a PR!

Start with the shown getClusters endpoint and trace ClusterOperations and the Authorization Provider to find how comparable operations enforce permissions. Reproduce the request with a trusted client lacking platform authorizations, then verify that unauthorized clients are denied while authorized clients can still list clusters.

Written by the indexing model from the issue text.