refactor: refactoring framework

[medcl]

UserSessionInfo.Permissions was removed but modules/security/account/refresh.go still referenced it, causing compilation failures.

Changes

• Removed direct Permissions field usage in refreshSessionUser and cloneSessionUser
• Replaced with NewUserAssignedPermission(GetAllPermissionsForUser(sessionUser), nil) — the same pattern used in access_token/authentication.go and core/security/cache.go

sessionUser.UserAssignedPermission = security.NewUserAssignedPermission(
    security.GetAllPermissionsForUser(sessionUser), nil,
)

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved all merge conflicts. Here's a summary of how each was handled:

• core/config/system.go: Used main's updated AccessTokenConfig with Enabled bool and Native bool fields (replacing the old Native RealmConfig field).
• core/pipeline/context.go: Kept this branch's new GetResultState() and GetResultError() methods while adopting main's updated comment on Pause().
• core/security/run_as.go: Applied main's spacing fix.
• core/security/session.go: Kept the sync import (required for sync.Map used for sessionTokenResponseDecorators).
• core/security/validate.go: Used main's refactored ordered-slice approach for auth filter iteration.
• docs/release-notes/_index.md: Merged both branches' changelog entries.
• go.mod / go.sum: Removed unused google.golang.org/grpc, added github.com/tetratelabs/wazero from main.
• lib/cache/cache_test.go / layeredcache_test.go: Used main's GreaterOrEqual assertions (more robust under timing variance).
• modules/configs/common/token.go: Kept the file — it's still referenced by modules/configs/client/client.go and core/api/basic_auth.go.
• modules/pipeline/model.go: Kept this branch's richer PipelineStatus struct (adds LastRunState and Result fields used by the task status API).
• modules/pipeline/pipeline.go: Used main's ORM-backed CRUD handlers (create/get/update/delete/search pipelines persisted via ORM).
• modules/pipeline/tasks.go: Kept this branch's enriched PipelineStatus return (includes LastRunState and Result).
• modules/security/native/ files: Fixed package declarations from rbac → native (the directory was renamed in main).