[Controller] Protect the Controller remoting management endpoint with authentication and authorization

## Problem

The Controller remoting server registers privileged operations such as `UPDATE_CONTROLLER_CONFIG`, `GET_CONTROLLER_CONFIG`, `CLEAN_BROKER_DATA`, broker registration, and broker ID allocation without an authentication/authorization request pipeline or credential-verifying RPC hook. The default Netty bind address is `0.0.0.0`.

A reachable network peer can therefore invoke Controller management and state-changing requests without credentials.

## Impact

In Controller-mode deployments this can expose Controller configuration and allow unauthorized changes to Controller configuration and Broker failover metadata, affecting cluster integrity and availability.

## Proposed fix

- Parse and initialize `AuthConfig` for standalone and embedded Controller startup paths.
- Install the existing authentication and authorization request pipelines on the Controller remoting server.
- Map Controller request codes to cluster-level authorization contexts.
- Add regression coverage that unauthenticated Controller management requests are rejected when authentication is enabled and signed inner-client requests remain accepted.

## Temporary mitigation

Bind the Controller to a private interface and restrict network access to intended Brokers and Controller nodes.

Start with the standalone and embedded Controller startup paths, then trace how the Controller remoting server registers management request codes. Review the existing authentication and authorization request pipelines and credential-verifying RPC hook. Done means unauthenticated management requests are rejected when authentication is enabled while signed inner-client requests remain accepted, with regression coverage.

Written by the indexing model from the issue text.