feat(dav): limit scoped app passwords to the collections they open

[pringelmann]

• Resolves: Scoped app passwords: DAV #65527

Note

I'm new to DAV and leaned heavily on Claude for this PR. I went through the code with it until I understood how the plugin hooks into Sabre and why each rule is there, but reviews from people who know DAV well would help the most here, especially on the calendar and contacts rules.

Summary

Stacked on #65340, which does the same for index.php and OCS.

Sabre plugin that refuses DAV requests outside the token's scopes (403) and drops refused items from multistatus responses, so multiget can't read around it. Loaded in remote.php/dav and the legacy caldav, carddav and webdav endpoints. Default deny per top-level collection.

• Files collections need files:read. Writes are left to the mount permissions
• Calendars and contacts: read or write scope by HTTP method. No sharing, publishing or calendar proxies
• App calendars and address books are hidden; birthdays also need contacts:read
• Tag definitions are read-only

Tokens without scopes aren't affected.

Testing

Tested locally with Thunderbird 140.17.0 and a calendar:read calendar:write token:

• Discovery finds only Personal user calendar. The birthday calendar is hidden without contacts:read
• Create, edit and delete events sync both ways
• Inviting an external attendee: the server sends the invitation
• A files:* token finds no calendars

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI (some dav-related code, tests, all reviewed by me)

[pringelmann]

Drafting for now, got feedback that necessitates major changes