Explain why the permission check stays at the HTTP layer

Motivation:

It was asked during the review why the permission check of the secret
regeneration is not performed inside the content transformer.

Modifications:

- Add a comment that the metadata layer is caller-agnostic and the permission
  is checked at the HTTP layer like the other endpoints.

Result:

- No behavior change.

Author: ikhoon

server/src/main/java/com/linecorp/centraldogma/server/internal/api/sysadmin/AppIdentityRegistryService.java

@@ -260,6 +260,8 @@ public CompletableFuture<AppIdentity> updateAppIdentity(ServiceRequestContext ct
     public CompletableFuture<Token> regenerateTokenSecret(ServiceRequestContext ctx,
                                                           @Param String appId,
                                                           Author author, User loginUser) {
+        // The permission is checked at the HTTP layer like the other endpoints; the metadata layer is
+        // caller-agnostic and validates only the token state.
         return getTokenOrRespondForbidden(ctx, appId, loginUser).thenCompose(
                 token -> {
                     if (token.isDeleted()) {