fix: Allow admins to restart other's session

[rapsealk]

This PR adds an optional parameter owner-access-key to session restart command, and updates the corresponding request handler to allow new parameter owner_access_key which can be different from requester_access_key. owner_access_key has been always the same with requester_access_key, which means any admin could not restart other user's session.

backend.ai/src/ai/backend/manager/api/session.py

Lines 1349 to 1354 in dec5284

	@server_status_required(READ_ALLOWED)
	@auth_required
	async def restart(request: web.Request) -> web.Response:
	root_ctx: RootContext = request.app["_root.context"]
	session_name = request.match_info["session_name"]
	requester_access_key, owner_access_key = await get_access_key_scopes(request)

backend.ai/src/ai/backend/manager/api/utils.py

Lines 57 to 65 in dec5284

	async def get_access_key_scopes(
	request: web.Request, params: Any = None
	) -> Tuple[AccessKey, AccessKey]:
	if not request["is_authorized"]:
	raise GenericForbidden("Only authorized requests may have access key scopes.")
	root_ctx: RootContext = request.app["_root.context"]
	owner_access_key: Optional[AccessKey] = (params or {}).get("owner_access_key", None)
	if owner_access_key is None or owner_access_key == request["keypair"]["access_key"]:
	return request["keypair"]["access_key"], request["keypair"]["access_key"]

Before	After

Checklist: (if applicable)

• Milestone metadata specifying the target backport version
• Mention to the original issue
• Documentation
• API server-client counterparts (e.g., manager API -> client SDK)
• Test case(s) to demonstrate the difference of before/after