feat(BA-5778): wire BulkActionRBACValidator to bulk permission check

[fregataa]

Summary

• Implement BulkActionRBACValidator.validate() to call check_bulk_permission_with_scope_chain() and split entity_ids into allowed/denied entries for the Bulk Processor's partial-success reporting (BA-5777).
• Superadmins bypass the DB lookup; missing user context raises UserNotFound, mirroring SingleEntityActionRBACValidator.
• Add TestBulkActionRBACValidator covering superadmin bypass, missing user, partial allow/deny split via self-scope permission, full-deny, and empty-batch cases.

Test plan

• pants fmt / fix / lint on changed files
• pants check tests/unit/manager/actions/validators/test_rbac_validators.py src/ai/backend/manager/actions/validators/rbac/bulk.py
• pants test tests/unit/manager/actions/validators/test_rbac_validators.py
• pants test tests/unit/manager/actions/test_bulk_processor.py (no regression)

Resolves BA-5778

[Copilot]

Pull request overview

This PR completes the RBAC enforcement path for bulk actions by implementing BulkActionRBACValidator.validate() using the permission controller’s bulk scope-chain check, enabling per-entity allow/deny results for partial-success bulk processing.

Changes:

• Implement BulkActionRBACValidator.validate() to call PermissionControllerRepository.check_bulk_permission_with_scope_chain() and return allowed_entity_ids plus DeniedEntity entries.
• Add superadmin bypass and missing-user (current_user() is None) handling consistent with existing RBAC validators.
• Add unit tests covering superadmin bypass, missing user context, partial allow/deny, full deny, and empty-batch behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/ai/backend/manager/actions/validators/rbac/bulk.py	Implements bulk RBAC validation using the repository bulk scope-chain permission check and returns per-entity decisions.
tests/unit/manager/actions/validators/test_rbac_validators.py	Adds test action/fixtures and a new TestBulkActionRBACValidator suite validating expected allow/deny splitting and edge cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[seedspirit]

Does "Bulk Validation" mean that permission checks for multiple operations performed by a single user are carried out in bulk? Could you please confirm whether this refers to validating operations performed by a single user rather than multiple users?

[fregataa]

Does "Bulk Validation" mean that permission checks for multiple operations performed by a single user are carried out in bulk? Could you please confirm whether this refers to validating operations performed by a single user rather than multiple users?

bulk validation means validating multiple entities in a single user, single entity type, single operation type

[jopemachine]

CI is broken