Issue #3608216: Enforce authorization on the webform interaction entry path

Enforces on the webform interaction entry path the authorization the dispatcher enforces. Fixes two gaps found by the release-candidate audit.

H3: bearer-token resume could reach a later step

confirmForm minted an instance-scoped capability token on a start, authorizing its holder to resume whatever the run parked on later (including an operator task the starting party should never complete). Scope the start return link to the run's first parked token, as a resume already scopes to its branch. A token-scoped handle can only resume the step it names (and, once consumed, a token re-parked on the same node), so it cannot roam to a later step: resumeTarget()'s fallback is the same node, never the whole instance.

H4: unauthenticated task-handle bind

preSave bound a submission to the instance named by any resolved handle, unconditionally. An orchestra-task:{id} handle resolves for any token id with no authorization (the resume is gated, not the bind), so an anonymous visitor could bind their submission as a source entity of any instance and surface it to the operator's review. Gate the bind with the same authorization the resume applies: add authorize() to the resumer interface (the capability resumer authorizes any holder of the already-validated bearer handle; the assignment resumer authorizes only the assigned, authenticated actor via userCanAct), and bind only when it passes.

Testing

Regression test: the assignment resumer's authorize() refuses a non-assignee and allows the assignee (the gate the bind relies on). Webform (14) and interaction-task (5) kernel suites green; phpcs clean. Orchestra is at alpha and not covered by the security advisory policy, so this is filed publicly.

Fixes #3608216.