Added permissions checker into HandleGetFileMetadata handler

[BarathaAberathne]

What

• Moved GET /files/{path} authorization into the handler so it can use metadata attributes (dataset_edition) for permission checks.
• Enforced JWT‑only access for file metadata (service tokens rejected) and validated JWTs via middleware parse.
• Added/updated unit and component tests.

How to review

• Run dataset-catalogue stack
• Make sure the dis-auth-stub contains a correct viewer account
• export AUTHORISATION_ENABLED=true
• Add the matching permission set to the db

{
    "_id" : "default-viewer",
    "condition" : {
        "attribute" : "dataset_edition",
        "operator" : "StringEquals",
        "Values" : [ 
            "static-test-dataset", // add allowed datasets and editions for the viewer
            "static-test-dataset/time-series"
        ]
    },
    "entities" : [ 
        "groups/role-viewer"
    ],
    "role" : "datasets-previewer"
}

Make sure the acceptance Criteria is met for each endpoint:

• Given a user accesses the /downloads/files/{file-path} endpoint in the download-service in the publishing environment for a file that is not published, when they are in the correct permissions group, then access to the file download is provided with a 200 response.
• Given a user accesses the /downloads/files/{file-path} endpoint in the download-service in the publishing environment for a file that is not published, when they are not in the correct permissions group, then a 403 response is returned.
• Given a user accesses the /downloads/files/{file-path} endpoint in the download-service in the publishing environment for a file that is not published, with no jwt token provided then a 401 response is returned.
• Given a user accesses the /downloads/files/{file-path} endpoint in the download-service in the publishing environment for a file that is not published, with an invalid jwt token provided then a 401 response is returned.
• Given a user accesses the /downloads/files/{file-path} endpoint in the download-service in the publishing environment for a file that is not published, with a valid service token then a 401 response is returned.

Who can review

Describe who worked on the changes, so that other people can review.