[air] Apply permissions to direct-run jobs and MLflow experiments

[caroline-db]

Changes

• Apply configured additive permission grants to both the submitted job and its MLflow experiment for direct AIR runs.
• Translate supported job permission levels to their MLflow equivalents and reject unsupported mappings before sending permission updates.
• Keep permission application best-effort so a successfully submitted workload is not reported as failed, while preserving existing validation and convert-to-DABs behavior.

Why

The Go AIR CLI accepted permission configuration for direct runs but did not apply it. This matches the Python AIR CLI behavior so configured principals receive access to both resources created for a run.

Tests

• Added unit coverage for experiment creation, permission-level mapping, principals, outgoing ACL payloads, and unsupported levels.
• Updated the AIR run-submit acceptance test to verify experiment creation and both permission PATCH requests.
• Ran go test ./experimental/air/cmd, the focused AIR acceptance test, ./task fmt, ./task checks, ./task lint, and the forced full ./task test suite.
• Manually tested the same configuration before and after the change. Before the change, the run submitted without propagating the grants. After the change, a test group received CAN_VIEW on the submitted job and CAN_READ on the MLflow experiment.

This PR was written with Codex.

[github-actions]

An authorized user can trigger integration tests manually by following the instructions below:

Trigger:
go/deco-tests-run/cli

Inputs:

• PR number: 6652
• Commit SHA: e5e2694d6284c96f2a510be8acb88cc61c89efb9

Checks will be approved automatically on success.

[caroline-db]

Superseded by #6653, which uses an upstream branch so secret-dependent CI can run.