Add authorization checks for custom tools

What does this MR do and why?

issue: #576975 (closed)

Currently, in MCP custom tools, we are only extracting the current_user but we don't do any further ability checks for it. In the SearchCodebaseService for example, we are relying on the underlying class semantic search class to do the authorization, see this check

This MR adds authorization in the MCP custom tools:

1. early authorization and means we can early return if the user is not authorized
2. this change also forces custom tool to do authorization to avoid the risk of adding a new tool without authorization

Test locally

reference: !205297 (comment 2756113040)

tiangao@tgao--20240202-M7DJJ ~ % rm -rf  ~/.mcp-auth     
tiangao@tgao--20240202-M7DJJ ~ % npx @mcpjam/inspector  

and add:

   {
     "mcpServers": {
       "GitLab-Production": {
         "command": "npx",
         "args": ["-y", "mcp-remote@latest", "https://gdk.test:3443/api/v4/mcp", "--debug", "--static-oauth-client-metadata", "{\"scope\": \"mcp\"}"],
         "env": {"NODE_TLS_REJECT_UNAUTHORIZED": "0"}
       }
     }
   }

before:

after:

we instead see this error: {"error":"Tool execution failed: CustomService: User 46 does not have permission to read_code for target 1000000c"}%

References

Screenshots or screen recordings

Before	After

How to set up and validate locally

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.