Add access level restriction to auth tokens

[mneudert]

Description

Until now, every auth token in Matomo inherited the full permissions of the user who created it. That meant a token shared with a third-party tool, or accidentally leaked, could do anything its owner could do — including superuser actions for superuser accounts. There was no way to hand out a "read-only" or "write-only" token without creating a separate user just for that purpose.

This PR introduces per-token access levels. When creating a new auth token, users can now choose the highest permission level the token is allowed to use: inherit the user's own access (the existing behaviour, and the default), or restrict the token to view, write, or admin. Superusers can also issue superuser-scoped tokens. The dropdown only offers levels the creator is themselves allowed to grant, so an admin user cannot mint a superuser token.

At request time, Matomo enforces the chosen ceiling across all entry points — the reporting API, tracker, and CLI alike. A token marked as write-only will be treated as write-only even if the underlying user account is a superuser, so the worst a leaked token can do is bounded by what was selected when it was created. Existing tokens are unaffected: a NULL access level continues to mean "inherit the user's access", which preserves the previous behaviour for every token created before the upgrade.

Checklist

• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules

Review

• Functional review done
• Potential edge cases thought about (behaviour of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• New documentation added or existing documentation updated

[github-actions]

If you don't want this PR to be closed automatically in 28 days then you need to assign the label 'Do not close'.