[BUG] MetaDataServiceImpl.enabledByIdsAndNamespaceId updates metadata across namespaces (cross-namespace authorization bypass)

- severity: High
- files: `shenyu-admin/src/main/java/org/apache/shenyu/admin/service/impl/MetaDataServiceImpl.java:124-136`
- description: `selectByIdListAndNamespaceId(ids, namespaceId)` scopes the existence check by `namespaceId`, but the subsequent `metaDataMapper.updateEnableBatch(ids, enabled)` (line 132) is passed the **raw `ids`** with no `namespaceId` filter (verified: the mapper SQL at `meta-data-sqlmap.xml:225` is `WHERE id IN (...)` with no namespace). If a caller in namespace A supplies `ids = [id-in-A, id-in-B]`, the select returns only the A row (non-empty), so the method proceeds, and `updateEnableBatch` enables/disables the B row too.
- impact: A user scoped to one namespace can enable/disable metadata belonging to another namespace, breaking namespace isolation and potentially disabling traffic in unrelated namespaces.
- suggested_fix: Pass the filtered id list (`metaDataDoList.stream().map(MetaDataDO::getId)`) to `updateEnableBatch`, or add a `namespaceId` overload of the mapper update.
- confidence: High
- related_existing: none. The baseline MetaData items cover other concerns; this is a cross-namespace mutation bug.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._