Require ReadInstance permission in ConnectorService handlers

[nishantmonu51]

The ConnectorService handlers (ListBuckets, ListObjects, OLAPListTables, OLAPGetTable, ListDatabaseSchemas, ListTables, GetTable) performed no permission checks, so any caller with a valid JWT for the runtime (or none at all) could enumerate OLAP tables, connector schemas, and object storage contents. All seven now require ReadInstance on the requested instance.

• ReadInstance matches AnalyzeConnectors, the sibling endpoint powering the same connector explorer UI, and is held by every legitimate caller: Rill Developer (auth disabled), the Cloud status page (gated on manageProject), cloud editing, and the admin service account.
• ReadOLAP was not used for the OLAP endpoints because it is only granted on editable deployments, which would break the status page's tables tab on prod. ReadObjects was not used for the object store endpoints because it is part of every viewer's base grant and would not restrict access.
• Because permissions are resolved for the requested instance_id, the check also prevents using a JWT issued for one instance against another instance on the same runtime.

Checklist:

• Covered by tests
• Ran it and it works as intended
• Reviewed the diff before requesting a review
• Checked for unhandled edge cases
• Linked the issues it closes
• Checked if the docs need to be updated. If so, create a separate Linear DOCS issue
• Intend to cherry-pick into the release branch
• I'm proud of this work!