security: add authorization checks to MetricsHandler

[adilburaksen]

Summary

The Studio metrics endpoints in MetricsHandler (cdap-watchdog) select metrics by
caller-supplied tag values (namespace, app, program, …) but never enforce
authorization, so any authenticated user can read or enumerate the operational metrics
of any namespace/app/program:

• POST /v3/metrics/query → MetricsQueryHelper.executeBatchQueries / executeTagQuery
• POST /v3/metrics/search → searchTags / searchMetric

The CDAP router authenticates but does not perform per-resource authorization — that is
the handler's responsibility. The sibling observability handler in the same module,
LogHttpHandler, already enforces StandardPermission.GET on the target program before
returning logs (ensureVisibilityOnProgram); MetricsHandler was added without the
equivalent check. Metrics are namespace-scoped — DefaultMetricStore aggregates on the
namespace tag — so this is a real cross-namespace authorization gap, not just a modeling
concern.

Fix

Inject ContextAccessEnforcer and, before executing any query/search, derive the target
namespace from the request tags and enforce StandardPermission.GET:

• a query naming a namespace requires GET on that NamespaceId;
• a namespace-less (cross-namespace) query requires GET on the system namespace;
• for the batch path, each sub-query's tags are enforced individually.

ContextAccessEnforcer is already bound in the metrics-query injector
(MetricsTwillRunnable / MetricsServiceMain / StandaloneMain all install
AuthorizationEnforcementModule), so no wiring change is needed. This mirrors the
existing security: add authorization checks to … handler hardening.

Testing

I verified the gap and the enforcement points by source inspection (no AccessEnforcer
reference existed in MetricsHandler, unlike its sibling LogHttpHandler). I don't have
a local Apple/CI build environment to run the watchdog suite; happy to add a unit test
(e.g. asserting an unauthorized principal is rejected before the query executes) in the
style the reviewers prefer.

[gemini-code-assist]

Warning

Gemini encountered an error creating the review. You can try again by commenting /gemini review.