[Client] [Server] Add temporary write authorization for bulk-load sessions

[platinumhamburg]

Search before asking

• I searched in the issues and found nothing similar.

Description

Bulk-load builders must write snapshot and manifest files to remote storage.
The existing client credential flow may provide read-only access, which is
insufficient in a production environment.

Add a least-privilege mechanism that allows an authorized caller to obtain
temporary write access for one active bulk-load transaction. The authorization
must integrate with openBuildSession without placing credentials in the
serializable build context.

This task should align with a future complete authorization system, but it does
not introduce general-purpose ACL or RBAC management.

Scope

• Authorize the caller before issuing temporary write access.
• Scope the authorization to one BulkLoad transaction and its allowed remote
  storage location.
• Grant only the operations required to write and finalize build artifacts.
• Acquire the authorization when opening a build session.
• Make the authorization available to bucket and manifest writers through the
  session.
• Define expiration behavior for temporary credentials.
• Define how builds that run longer than one credential lifetime continue or
  fail.
• Prevent credentials from being serialized into build contexts, engine
  checkpoints, manifests, logs, or error messages.
• Ensure closed or expired sessions cannot silently continue using invalid
  credentials.
• Keep caller identity server-derived so the mechanism can evolve into the
  future authorization model.

Willingness to contribute

• I'm willing to submit a PR!