Bug 36561: Make /auth/password/validation use new permission

This patch updates the /auth/password/validation endpoint to use the new
api_validate_password permission instead of the generic borrowers
permission.

This provides more granular control over who can use the password
validation API endpoint.

To test:
1. Apply this patches
2. Rebuild the API spec
   $ ktd --shell
  k$ yarn api:bundle
3. Run:
   $ ktd --shell
  k$ prove t/db_dependent/api/v1/password_validation.t
=> SUCCESS: Tests pass!
4. Sign off :-D

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 812b38d02c)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>

api/v1/swagger/paths/auth.yaml

@@ -1183,4 +1183,4 @@
           $ref: ../swagger.yaml#/definitions/error
     x-koha-authorization:
       permissions:
-        borrowers: "1"
+        borrowers: api_validate_password

t/db_dependent/api/v1/password_validation.t

@@ -40,9 +40,22 @@ $schema->storage->txn_begin;
 my $librarian = $builder->build_object(
     {
         class => 'Koha::Patrons',
-        value => { flags => 2**4 }    # borrowers flag = 4
+        value => { flags => 0 }     # No top-level permissions
     }
 );
+
+# Ensure our librarian can see users from all branches (once list_borrowers is added)
+$builder->build(
+    {
+        source => 'UserPermission',
+        value  => {
+            borrowernumber => $librarian->borrowernumber,
+            module_bit     => 4,
+            code           => 'api_validate_password',
+        },
+    }
+);
+
 my $password = 'thePassword123';
 $librarian->set_password( { password => $password, skip_validation => 1 } );
 my $userid = $librarian->userid;