better permission check for outdated index deletion

[todvora]

Description

The POST /api/system/indexer/indices/outdated/bulk_delete endpoint (added in 7.2) only enforced the indices:delete permission deep inside its per-index loop, after it had already enumerated all outdated indices on the cluster via @RequiresAuthentication alone. This let any authenticated user with no index permissions trigger the cluster-wide enumeration, and let the differing per-index failure messages ("not found" vs "not authorized") act as an index-membership oracle. This PR adds an upfront check in bulkDeleteOutdated that rejects the request with 403 Forbidden before any work is done, unless the caller holds the general indices:delete permission or a per-index grant for at least one of the submitted entity_ids — preserving the existing per-managed-index permission model (see deleteSingleOutdated) while closing the gap.

Motivation and Context

Fixes https://github.com/Graylog2/graylog-plugin-enterprise/issues/15476

How Has This Been Tested?

Added unit tests

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactoring (non-breaking change)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have requested a documentation update.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.