server: statement diagnostics download endpoint does not correctly validate user auth

[dhartunian]

Describe the problem

The HTTP endpoint for downloading statement diagnostics bundles does not correctly validate the authenticated user's privileges. A user without admin privileges can download a bundle given the URL or an ID that they receive or guess.

To Reproduce

start a server.

• create a non-privileged user e.g. create user foo with password abc
• have root create a statement diagnostic bundle, e.g.: explain analyze (debug) select 'secret';
• separately, have user foo get a login token from the HTTP API using their password
• make the foo user access the stmt bundle endpoint using their token. For example:
  • curl -k --cookie '...' https://localhost:8080/_admin/v1/stmtbundle/836995973036048385

Expected behavior
The user should receive an error when they attempt to download the bundle

Environment
CRDB v20.1 and later is affected (since this feature was added)

Additional Context
The code that implements the zip download endpoints is unconventional because it does not use gRPC for the file download and hence does not process authorization metadata in the same manner as code in other gRPC HTTP handlers.

Jira issue: CRDB-25680