Bug 39142: (QA follow-up) Add permission checking for syspref overrides

This follow-up adds proper security controls for the DISABLE_SYSPREF_*
URL parameter functionality introduced in Bug 14004. Previously, any
user could bypass system preferences by using URL parameters without
authorization.

Changes:
- Restricts DISABLE_SYSPREF_* parameter processing to users with debug permission
- Uses existing haspermission() method for consistent authorization checking
- Maintains superlibrarian access as expected
- Closes potential security loophole where unauthorized users could disable
  system preferences like IntranetUserJS and IntranetUserCSS

The debug UI buttons will only appear for authorized users, and now the
underlying syspref override functionality requires the same permission,
ensuring both UI and functional security are aligned.

Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

C4/Auth.pm

@@ -444,21 +444,24 @@ sub get_template_and_user {
 
     # Sysprefs disabled via URL param
     # Note that value must be defined in order to override via ENV
-    foreach my $syspref (
-        qw(
-        OPACUserCSS
-        OPACUserJS
-        IntranetUserCSS
-        IntranetUserJS
-        OpacAdditionalStylesheet
-        opaclayoutstylesheet
-        intranetcolorstylesheet
-        intranetstylesheet
-        )
-        )
-    {
-        $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{}
-            if $in->{'query'}->param("DISABLE_SYSPREF_$syspref");
+    # Only allow syspref overrides for users with debug permission
+    if ( C4::Context->userenv && haspermission( C4::Context->userenv->{'id'}, { debug => 1 } ) ) {
+        foreach my $syspref (
+            qw(
+            OPACUserCSS
+            OPACUserJS
+            IntranetUserCSS
+            IntranetUserJS
+            OpacAdditionalStylesheet
+            opaclayoutstylesheet
+            intranetcolorstylesheet
+            intranetstylesheet
+            )
+            )
+        {
+            $ENV{"OVERRIDE_SYSPREF_$syspref"} = q{}
+                if $in->{'query'}->param("DISABLE_SYSPREF_$syspref");
+        }
     }
 
     # Anonymous opac search history