RBAC read-deny: precise per-endpoint permission (extract mapping) + allow counterparts

Follow-up to the read-side RBAC deny-test vertical slice (#359). The slice is generic (zero-grant user → deny). This adds precise per-endpoint RBAC: name the exact permission that gates each read endpoint and assert both directions.

Scope:

• Extract the read endpoint→permission mapping from camunda/camunda service/.../authorization/Authorizations.java (read-side constants like PROCESS_INSTANCE_READ_AUTHORIZATION are declarative/machine-extractable) into a config, e.g. configs/camunda-oca/read-permissions.json, and attach requiredPermission to OperationModel via the spec/registry loader.
• Deny test: grant the probe user everything except the target permission → assert deny (proves that permission gates the endpoint).
• Allow counterpart: grant the probe user exactly the target permission → assert 200.

Why after the slice: the camunda/camunda extraction is its own focused change and the generic slice already establishes the scoped-user + authz-run-mode infra.

Relates to #359. The write-side analog is blocked on upstream camunda/camunda#54727.

Start with the read-side constants in camunda/camunda's service/.../authorization/Authorizations.java, then inspect the spec/registry loader and OperationModel. Add the extracted mapping at configs/camunda-oca/read-permissions.json and wire requiredPermission through the model. Done means each read endpoint has deny and allow coverage using the exact permission, building on the infrastructure from #359.