feat: add @libre.graph.permissions.actions.allowedValues to driveItem

Adds an optional, `$select`-gated instance annotation on `driveItem` that
carries the list of libre.graph actions the caller is allowed to perform on
the item. Mirrors the annotation of the same name on the `/permissions`
endpoint so clients (e.g. a sharing dialog in a search/listing UI) can get
the effective-actions view inline without a separate round-trip per item.

- Adds `@libre.graph.permissions.actions.allowedValues` to the `driveItem`
  schema, marked read-only and documented as only populated when requested.
- Adds a reusable `driveItemSelect` component parameter with a narrow enum,
  following the same pattern as PR #38 (feat/download-url). When both land,
  the enum values merge.
- Wires the new parameter to `GetDriveItem`.

Rationale discussed in #34.

Author: dschmidt

api/openapi-spec/v1.0.yaml

@@ -4990,6 +4990,21 @@ components:
         '@UI.Hidden':
           description: Properties or facets (see UI.Facet) annotated with this term will not be rendered if the annotation evaluates to true. Users can set this to hide permissions.
           type: boolean
+        '@libre.graph.permissions.actions.allowedValues':
+          type: array
+          description: |
+            A list of actions the caller is allowed to perform on this item.
+
+            Only returned when explicitly requested via `$select` on endpoints
+            that support it. Mirrors the annotation of the same name on the
+            `/permissions` endpoint, allowing clients to learn a caller's
+            effective actions on an item without a separate round-trip.
+
+            See the `/permissions` endpoint for the mapping between CS3
+            `ResourcePermissions` and libre.graph actions.
+          items:
+            type: string
+          readOnly: true
     sharingLinkType:
       type: string
       enum: [ internal, view, upload, edit, createOnly, blocksDownload ]
@@ -5987,7 +6002,10 @@ components:
     driveItemSelect:
       name: $select
       in: query
-      description: Select additional properties to be returned.
+      description: |
+        Select properties to be returned. By default all properties are returned, except for
+        instance annotations (prefixed with `@`) that are computationally expensive or
+        short-lived. Instance annotations must be explicitly requested via `$select`.
       style: form
       explode: false
       schema:
@@ -5996,11 +6014,15 @@ components:
         items:
           enum:
             - '@microsoft.graph.downloadUrl'
+            - '@libre.graph.permissions.actions.allowedValues'
           type: string
       examples:
         request download url:
           value:
             - '@microsoft.graph.downloadUrl'
+        request allowed actions:
+          value:
+            - '@libre.graph.permissions.actions.allowedValues'
     drivesFilter:
       name: $filter
       in: query