[2.1 Docs] Platform: Permission enforcement changes #689

Documentation work verified against the merged source PRs and the 2.1.0-rc1 release for the 2.1 release. Items were checked against the code change (not only the PR title) and against the pages that exist today.

Area: Platform
Scope: OpenMetadata
Related: #608

Summary
Sub-resources and list or admin endpoints now check permissions the way their parent entity does, so users without view or edit rights get 403 or filtered results. Deleting a test case result needs DELETE on either the table or the test case. The search aggregate endpoint now applies RBAC conditions. A rule removed from a policy applies on the next authorization decision. Service connection details are returned in full only to bots, masked for editors and hidden from view-only users.

Source PRs

• OpenMetadata#34838: fix(security): enforce authorization on sub-resource, listing and admin endpoints OpenMetadata#34838
• OpenMetadata#34521: Fixes #34463: authorize test case result deletion with ANY, not ALL OpenMetadata#34521
• OpenMetadata#35148: Fixes #35086: enforce RBAC on /v1/search/aggregate endpoint OpenMetadata#35148
• OpenMetadata#34940: Fixes #34826: apply a removed policy rule on the next authorization decision OpenMetadata#34940
• OpenMetadata#36219: fix(security): restrict service connection reads to bots and editors OpenMetadata#36219

Doc tasks

• Update the authorization page: sub-resource and list endpoints (system profiles, entity relationships, pipeline status history, KPI results, data contract validate, audit report cancel, workflow trigger and redeploy, AI governance framework fork, intake forms) now enforce the parent's permission
• Document the new rule for deleting a test case result and update the test case result API reference
• Update the RBAC Search policy page: /v1/search/aggregate enforces the caller's policy conditions, so counts change for restricted users
• Add a note on policy editing: a removed rule takes effect on the next authorization decision
• Document service connection masking: full for bots, masked for EDIT_ALL editors, hidden for view-only users; the built-in OpenMetadata service no longer stores the search sink or the ingestion bot JWT

Pages to check: admin-guide/roles-policies/, admin-guide/delete-service-connection.mdx, admin-guide/how-to-ingest-metadata.mdx, developer-guide/api-reference/ (services, test case results)

OpenMetadata-side items only. Collate-only changes are tracked in docs-collate. Page names are the docs-collate ones; locate the matching page under v2.1.x-SNAPSHOT/.