Enforce IAM authorization on every console resolver

Audited pkg/server/api/console/v1 for resolvers that touched tenant
data without calling r.authorize, batchAuthorize, or Permission. Closed
every gap so every data-bearing field goes through IAM (and produces an
audit log entry when an organization_id is present).

* High-severity reads now authorize: accessSourceResolver.Connector and
  ConnectionStatus, controlResolver.Regulatory/Contractual/RiskAssessment,
  electronicSignatureResolver.CertificateFileURL/Events,
  commonThirdPartyResolver.LogoURL, and the proper
  accessSourceResolver/accessReviewCampaignResolver/auditLogEntryResolver
  Organization resolvers (authorize + dataloader load, fixing the latent
  empty-name bug from the previous force-resolver no-op implementations).
* TotalCount/DetectedCount aggregates now authorize the matching list
  action across access review, audit log, statement of applicability,
  detected tracker, tracker pattern, and tracker resource connections.
* queryResolver.CommonThirdParties authorizes against the principal's
  identity via the new identity-scoped CommonThirdPartyCatalogPolicy.
* Add ActionCommonThirdPartyGet/List, ActionElectronicSignatureGet probo
  action constants; wire ActionElectronicSignatureGet into ViewerPolicy
  and AuditorPolicy.
* Implement AuthorizationAttributes on CommonThirdParty (no org) and
  ElectronicSignature (organization_id) so the authorizer can resolve
  attributes for the new actions.
* Delete the dead "type AccessReview" GraphQL type (no Go constructor,
  no frontend reference) and drop its orphan resolver bundle.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/console/v1/graphql/access_review_campaign.graphql

@@ -284,32 +284,6 @@ input AccessEntryFilter
     accountType: AccessEntryAccountType
 }
 
-type AccessReview implements Node {
-    id: ID!
-    organization: Organization! @goField(forceResolver: true)
-    identitySource: AccessSource @goField(forceResolver: true)
-    createdAt: Datetime!
-    updatedAt: Datetime!
-
-    accessSources(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: AccessSourceOrder
-    ): AccessSourceConnection! @goField(forceResolver: true)
-
-    campaigns(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: AccessReviewCampaignOrder
-    ): AccessReviewCampaignConnection! @goField(forceResolver: true)
-
-    permission(action: String!): Boolean! @goField(forceResolver: true)
-}
-
 type ProviderOrganization {
     slug: String!
     displayName: String!

pkg/server/api/console/v1/graphql/organization.graphql

@@ -227,14 +227,6 @@ type Organization implements Node {
         filter: DocumentFilter
     ): DocumentConnection! @goField(forceResolver: true)
 
-    evidences(
-        first: Int
-        after: CursorKey
-        last: Int
-        before: CursorKey
-        orderBy: EvidenceOrder
-    ): EvidenceConnection! @goField(forceResolver: true)
-
     frameworks(
         first: Int
         after: CursorKey