fix(authz): prove query fields within enforced tenant scopes

[rrrodzilla]

A tenant-keyed custom forbid currently blocks filters and sorts on every @field_access field, including requests from an allowed tenant or an exempt platform administrator. Bind the field proof to the complete tenant scope enforced by the storage query, and require the original Cedar policy set to allow field reads for every candidate tenant.

Share the captured scope between authorization and filter injection across REST, JSON queries, GraphQL, and export acceptance/execution. Keep admin and disabled-tenancy queries unscoped. Recognize ordered Boolean conditions that prove a policy independent of records for the caller, preserving evaluation errors and optional-attribute guards. Keep generated-policy integrity checks, concrete resource ancestry, public APIs, and dependency features unchanged.

Prepare CLI 0.52.3 and runtime 0.50.2 as patch releases for existing query behavior.

Fixes #256.

Validation:

• Reproduced both reported 403 responses with new live SurrealDB regressions against unchanged production code.
• Independently reproduced admin/member filtering, sorting, root queries, and CSV export denials with the published v0.52.2 PostgreSQL executable, real login, and active-tenant switching; projection remained available.
• 149 focused authorization, tenant, REST/JSON, GraphQL, and export regressions passed, including actual asynchronous export execution and differential Boolean proof checks against Cedar.
• All 113 CI policy tests, Rust formatting, release metadata, and signed-commit verification passed.
• Locked all-target Clippy with test-surrealdb,graphql passed with zero warnings (-D warnings).
• Full CI passed: portable tooling/runtime/CLI, PostgreSQL (extensions enabled and disabled), SurrealDB and GraphQL, SQL Server 2019/2022, Windows compilation/signature checks, generated-site build/lint/browser checks, and CEL proofs. Run 38169362776.