access_control: Cache token lookup to reduce DB pool pressure

Fetch the token once per request and pass it through to is_test_request_owned_by_token and check_access_api_key instead of each function independently calling get_token_db. This eliminates 2-3 redundant queries and commits per request on the high-traffic GET/UPDATE/DELETE request endpoints, reducing connection hold time and mitigating QueuePool exhaustion.

Part of TFT-4873 Assisted-by: Claude Code