Security: Add missing authorization checks to web handlers

[Ashutosh0x]

Summary

Add missing authorization checks to three web handlers in ClusterFuzz to prevent unauthorized access to testcase data, coverage reports, and cross-object issue manipulation.

Problems Fixed

1. issue_redirector.py - Missing Access Control

The handler uses helpers.get_testcase() which only checks if a testcase exists, NOT if the current user has permission to view it. This leaks private issue tracker URLs to unauthorized users.

Fix: Replaced with access.check_access_and_get_testcase() which enforces proper permission checks.

2. coverage_report.py - Missing Job-Level Authorization

Any authenticated user can request coverage reports for any fuzzer job across any project, regardless of their access level.

Fix: Added access.has_access(job_type=job) check before serving coverage data.

3. update_issue.py - Cross-Object Authorization Bypass (IDOR)

The handler checks if the user has access to the testcase, but NOT to the target issue. Since it runs as a high-privilege service account, it can post comments and modify metadata on private issues in other projects.

Fix: Added user-association check verifying the requesting user is an admin, privileged user, or explicitly associated (reporter/assignee/CC) with the target issue.

Impact

Without these fixes:

• Unauthenticated users can enumerate testcase IDs and discover private issue URLs
• Any user can access coverage data for restricted projects
• Users with testcase access can modify unrelated private issues

Related

This PR extends the scope of #5258 by also fixing the cross-object authorization bypass in update_issue.py, which is not covered by PR #5259.

[Ashutosh0x]

@oliverchang @jonathanmetzman Hi! This PR adds missing authorization checks to three web handlers, extending the scope of #5258 / PR #5259:

1. issue_redirector.py - Replaced helpers.get_testcase() with access.check_access_and_get_testcase() (same fix as PR Add access checks to issue_redirector and coverage_report handlers #5259)
2. coverage_report.py - Added access.has_access(job_type=job) check (same fix as PR Add access checks to issue_redirector and coverage_report handlers #5259)
3. update_issue.py - NEW FIX not covered by PR Add access checks to issue_redirector and coverage_report handlers #5259: Added user-association check to prevent cross-object IDOR (testcase access allowing modification of unrelated private issues)

The update_issue.py fix is the key addition here - it prevents a cross-object authorization bypass where testcase-scoped access incorrectly allows updating unrelated issue IDs via the privileged service account.

CLA is signed. All basic checks passed. Could you please review and trigger the CI test suite?