refactor(AppFramekwork): Clarify SecurityMiddleware security checks

[joshtrichards]

• Resolves: #

Summary

Refactor SecurityMiddleware::beforeController() to make its security policy easier to follow without changing the established check order.

• Move metadata into clear predicates for cleaner authorization, cookie, and CSRF checks.
• Document compatibility behavior and policy rationale.
• Clean up outdated comments.
• Crucial: Retain original validation order to ensure error exceptions remain identical.

Notes

The Bearer authorization-scheme check is now case-insensitive, consistent with HTTP authentication-scheme matching.

TODO

• Confirm all existing tests pass
• Fill in test gaps:
  • AppAPI-without-user
  • authorized-admin-setting delegation
  • denied admin IPs.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI