Object actions: apply allowed_permissions in the change_actions fallback (defense-in-depth)

[MartinCastroAlvarez]

Found reviewing #427 (object-level change-page actions).

permitted_action_names (api/object_actions.py) has two paths:

1. get_change_actions(request, ctx, pk) — django-object-actions' permission-aware hook; applies each action's allowed_permissions internally. Authoritative + filtered. Standard usage hits this.
2. Fallback — a bare change_actions attribute with no hook: declared names are surfaced as-is, gated only by the run view's has_change_permission(request, obj). Per-action allowed_permissions are not applied here.

Impact is LOW: standard django-object-actions installs always provide get_change_actions (the mixin), so the fallback only triggers for a hand-rolled change_actions list. And has_change_permission still gates the object. But for parity with the changelist/bulk action endpoints (which filter via Django's _filter_actions_by_permissions), the fallback should also drop any action whose declared allowed_permissions the user fails.

Fix

In the change_actions fallback, filter each name by its callable's allowed_permissions against has_<perm>_permission(request) (mirror _filter_actions_by_permissions), before returning.

Acceptance

• A change_actions-only admin (no get_change_actions) with an action declaring allowed_permissions=["delete"] does not offer/run it for a change-only user.

Defense-in-depth, LOW severity. Tier 3/4.

[MartinCastroAlvarez]

Closing — out of v1 shipping scope for this repo (#544 collapsed it to the React-super-layer). Already merged via #543 (the fallback now filters by allowed_permissions); auto-close didn't fire on the squash. The code now lives in the API package.