Fix authorization for missing semantic model grant targets

[flyrain]

Semantic-model grant/revoke requests currently return HTTP 500 with built-in RBAC when the catalog, namespace, model, or recipient role is missing: authorization tries to read a fully resolved path before it can make a decision.

Retain validated ancestors during resolution for these two operations so RBAC can check the caller's existing grants. For example, a grant manager on a namespace gets HTTP 404 for a missing model within that namespace; a caller without the required privileges gets HTTP 403. Revoke still checks the recipient role's grant-management permission independently, and existence checks prevent changes when a target is missing. Missing catalogs return HTTP 403 under the existing privilege model.

Related to #5492; follow-up to the missing-target review discussion. Other operations retain their existing resolution behavior.

Checklist

• 🛡️ Don't disclose security issues! (contact security@apache.org)
• 🔗 Clearly explained why the changes are needed, or linked related issues: Related to Add semantic model privileges #5492
• 🧪 Added/updated tests with good coverage, or manually tested (and explained how)
• 💡 Added comments for complex logic
• 🧾 Updated CHANGELOG.md (if needed)
• 📚 Updated documentation in site/content/in-dev/unreleased (if needed)

Prepared with AI assistance.