[Security] Placement Policy Data Accessible Without Authorization

## Description
Placement policy data is accessible without proper authorization. Any client connected to the PD cluster can query and read placement policies without permission checks, exposing cluster configuration details.

## Steps to Reproduce
1. Client connects to PD cluster with low privilege
2. Queries endpoint: `/api/v1/placement/rules`
3. No authorization check performed
4. Returns all placement policies unfiltered
5. Cluster configuration exposed

## Environment Information
- API: PD HTTP API
- Authorization: RBAC not fully implemented
- Data: Placement policies, rules, constraints
- Access control: Missing on policy endpoints

## Expected Behavior
- Authorization check on policy endpoints
- Only authorized users see policies
- Role-based access control
- Audit logging of policy access

## Actual Behavior
- No authorization checks
- All policies visible to any client
- Configuration details exposed
- No access logging

## Code Reference
- File: `server/api/apiutil/apiutil.go`
- Endpoint: `/api/v1/placement/rules` - missing authz
- Missing: Authorization middleware
- Missing: Policy visibility filtering

## Additional Context
Level 2 security issue. Fix requires:
- Implementing authorization on policy endpoints
- Adding RBAC checks for policy access
- Filtering policies by user permissions
- Audit logging of policy queries

## Suggested Labels
`security`, `authorization`, `access-control`, `api-security`, `cluster-config`