feat: add per-credential access scope for builtin tool providers (#34…

[smartcoder0777]

Fixes: #34925

Summary

Implements per-credential access control for built-in plugin tool credentials in console and runtime.

• Adds credential visibility/usage scopes: workspace, private, and restricted (selected members).
• Enforces access at both listing and execution time: users only see/use credentials allowed by scope; runtime blocks unauthorized credential usage.
• Extends console API payloads and frontend auth UI to set/update scope and restricted member list.
• Persists scope and restricted-member mappings with new DB schema/migration and service-layer sync/validation.
• Updates unit tests for backend services/controllers to cover new access-control behavior.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran make lint && make type-check (backend) and cd web && pnpm exec vp staged (frontend) to appease the lint gods