[air] Apply permissions to direct-run jobs and MLflow experiments - #6652

Changes

• Apply configured additive permission grants to both the submitted job and its MLflow experiment for direct AIR runs.
• Translate supported job permission levels to their MLflow equivalents and reject unsupported mappings before sending permission updates.
• Keep permission application best-effort so a successfully submitted workload is not reported as failed, while preserving existing validation and convert-to-DABs behavior.

Why

The Go AIR CLI accepted permission configuration for direct runs but did not apply it. This matches the Python AIR CLI behavior so configured principals receive access to both resources created for a run.

Tests

• Added unit coverage for experiment creation, permission-level mapping, principals, outgoing ACL payloads, and unsupported levels.
• Updated the AIR run-submit acceptance test to verify experiment creation and both permission PATCH requests.
• Ran go test ./experimental/air/cmd, the focused AIR acceptance test, ./task fmt, ./task checks, ./task lint, and the forced full ./task test suite.
• Manually tested the same configuration before and after the change. Before the change, the run submitted without propagating the grants. After the change, a test group received CAN_VIEW on the submitted job and CAN_READ on the MLflow experiment.

This PR was written with Codex.