Apply RBAC validators to session actions missing permission checks

Following BA-5320 (define valid operation combinations for SESSION element type), apply RBAC validators to the 20 session actions that currently have no permission checks in their processors.

Current state:

- 10 session actions already have RBAC validation (6 scope, 4 single-entity)

- 20 session actions have NO RBAC validation

Actions missing RBAC validation, grouped by category:

File operations (4):

- upload_files (UPDATE)

- download_file (GET/READ)

- download_files (GET/READ)

- list_files (SEARCH/READ)

Service management (3):

- start_service (CREATE)

- shutdown_service (DELETE)

- get_direct_access_info (GET/READ)

Commit/Image (3):

- commit_session (CREATE)

- convert_session_to_image (UPDATE)

- get_commit_status (GET/READ)

Session lifecycle (3):

- rename_session (UPDATE)

- restart_session (UPDATE)

- interrupt (UPDATE)

Execution (1):

- complete (UPDATE)

Status/Information retrieval (6):

- check_and_transit_status (UPDATE)

- get_status_history (GET/READ)

- get_container_logs (GET/READ)

- get_dependency_graph (GET/READ)

- get_abusing_report (GET/READ)

Design considerations:

- Some actions use sub-entity types (SESSION_FILE, SESSION_APP_SERVICE, SESSION_COMMIT, SESSION_CONTAINER_LOG, etc.). Need to decide whether to cover them under SESSION-level permission or define separate RBAC actions per sub-entity type.

- check_and_transit_status may be an internal/system operation that should remain unvalidated.

- Prioritize user-facing API actions (file ops, service ops, rename, restart) over internal ones.

JIRA Issue: BA-5396