Cover access list authorization through the external authorize endpoint with integration tests #3922

Problem
The access list authorization boundary has integration coverage through the internal decision endpoint (ResourceRegistry_DecisionTests) and a single deny case on AccessListAuthorizationController from the prototype slice in PR #3873, but the literal external authorize endpoint (POST authorization/api/v1/authorize) has no access list scenarios at all. The Bruno suite under Authorize/AccessList encodes the intended behavior: AC1 and AC2 Permit, AC3 and AC4 Deny, each with and without a delegation, plus a system user permitted through a resource delegation. None of those outcomes are asserted in-process today.

Goal
The access list Permit and Deny outcomes are asserted through the external authorize endpoint, including the delegation variants and the system user resource-delegation case, as [IntegrationTest]s in Altinn.Authorization.Tests.

Approach
Port the residue identified by the gap report on #3378 after the prototype corrections: only the scenarios that go through the external authorize endpoint, not the AC1 to AC4 equivalents already covered through the internal decision endpoint. Use the Bruno requests under test/Authorize/AccessList as the behavioral spec for request shape and expected outcome. Follow the guard-pair pattern and the seed identities documented in SystemResourceTestData, and the existing external endpoint patterns in ExternalDecisionTest. Policy fixtures stay hand-mirrored stand-ins derived from the Bruno-asserted outcomes, matching the caveat recorded on #3378.

Work

• Permit through access list membership on the external authorize endpoint, with its non-member Deny guard pair
• The same pair with an access list delegation in place
• System user permitted through a resource delegation governed by an access list
• Seed data added as reusable fixture helpers so the later scenario groups on Expand integration-test coverage of under-tested API scenarios, using the deep Bruno scenarios as spec #3378 can pick them up

Out of scope

• The AC1 to AC4 equivalents through the internal decision endpoint, already covered by ResourceRegistry_DecisionTests
• Exporting the deployed access list policies into the fixtures
• The remaining scenario groups on Expand integration-test coverage of under-tested API scenarios, using the deep Bruno scenarios as spec #3378

Part of #3378.