fix(controlplane): enforce project RBAC on CAS download redirect lookups (PFM-6716)
What does this PR do?
Closes a project-isolation bypass in CASRedirectService/GetDownloadURL (PFM-6716). The endpoint resolved CAS mappings without RBAC scopes for API-token callers, so a project-scoped API token could mint a download URL for any artifact in its organization as long as it knew the digest. The sibling CASCredentialsService/Get endpoint already restricted the same lookup to the token's visible projects.
Both download endpoints now derive the lookup scopes from a single shared helper, rbacScopesForOrg, so the token-to-scope resolution lives in one place and cannot drift between the two download paths again. The helper documents the scope convention at the point of use: an organization present in the scopes map limits access to the caller's visible projects, while an absent one keeps the organization fully reachable for callers RBAC does not apply to.
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri