fix: enforce @RolesAllowed on microservice resources

[Yicong-Huang]

What changes were proposed in this PR?

Re-applies #5049 (Jersey @RolesAllowed enforcement on config-service, computing-unit-managing-service, and workflow-compiling-service) and additionally marks the two pre-login ConfigResource endpoints — /api/config/gui and /api/config/user-system — as @PermitAll. Those endpoints are loaded by GuiConfigService.load() in the Angular APP_INITIALIZER before any login, so once role enforcement is on they must keep returning 200 to unauthenticated callers; missing this was what broke bootstrap and got #5049 reverted in #5173. Everything outside config-service matches #5049 byte-for-byte.

Any related issues, documentation, or discussions?

Closes: #4904
Prior attempt: #5049, reverted by #5173. The bootstrap root cause was diagnosed inline at #5049 (comment).

How was this PR tested?

Added ConfigResourceAuthSpec: wires ConfigResource through the same JwtAuthFilter + RolesAllowedDynamicFeature pipeline production uses (via Dropwizard's ResourceExtension) and fires HTTP requests with no Authorization header.

• GET /config/gui → expects 200
• GET /config/user-system → expects 200
• GET /auth-probe (an in-test @RolesAllowed resource) → expects 403

The 403 sanity guard ensures the feature is actually enforcing, so a future "200 everywhere" regression cannot silently slip through. Kept the three *ServiceRunSpec structural tests from #5049 verifying that RolesAllowedDynamicFeature is registered. Manual reproduction with curl against a local dev server confirmed the unauthenticated bootstrap path returns 200 while a low-role JWT against an annotated endpoint returns 403.

Was this PR authored or co-authored using generative AI tooling?

Co-authored with Claude Opus 4.7 in compliance with ASF.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 56.25000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 45.50%. Comparing base (a25c543) to head (148873d).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
.../texera/service/ComputingUnitManagingService.scala	44.44%	5 Missing ⚠️
...ache/texera/service/WorkflowCompilingService.scala	66.66%	2 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #5199      +/-   ##
============================================
+ Coverage     45.39%   45.50%   +0.11%     
- Complexity     2218     2223       +5     
============================================
  Files          1042     1042              
  Lines         39989    39997       +8     
  Branches       4260     4260              
============================================
+ Hits          18152    18201      +49     
+ Misses        20720    20677      -43     
- Partials       1117     1119       +2     

Flag	Coverage Δ		*Carryforward flag
access-control-service	39.53% <ø> (ø)
agent-service	33.76% <ø> (ø)		Carriedforward from a25c543
amber	45.74% <ø> (-0.01%)	⬇️
computing-unit-managing-service	1.38% <44.44%> (+1.38%)	⬆️
config-service	64.51% <100.00%> (+64.51%)	⬆️
file-service	32.18% <ø> (ø)
frontend	37.79% <ø> (ø)		Carriedforward from a25c543
python	90.50% <ø> (ø)		Carriedforward from a25c543
workflow-compiling-service	58.39% <66.66%> (+1.57%)	⬆️

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Ma77Ball]

@Yicong-Huang I raised a similar pr to fix this. #5198

[Yicong-Huang]

@Yicong-Huang I raised a similar pr to fix this. #5198

I hope to minimize the change, this PR is reapplying #5049 with only two more line diff about permit all usage on configservice. could you please help test this one?

[Ma77Ball]

@Yicong-Huang I raised a similar pr to fix this. #5198

I hope to minimize the change, this PR is reapplying #5049 with only two more line diff about permit all usage on configservice. could you please help test this one?

That makes sense. I can help test and review later today when I get back home.

[carloea2]

Shouldn’t Matthew’s PR have priority?

Also this PR is bigger