[UI] Do not disclose a security testcase's issue through /issue/<testcase_id>

[r0g18]

issue_redirector.Handler loads the testcase with helpers.get_testcase, which does not authorize the caller, and then redirects to the associated issue URL. For a testcase with security_flag set, an unauthenticated caller who knows the testcase id learns that the testcase exists and which issue it is associated with — exactly what the protected testcase-facing endpoints withhold from that same caller.

This applies the policy already used by crash queries and by testcase downloads. PR #5297 states it directly for crash_query.py: "Do not disclose the existence or identifiers of a security-confidential testcase to a user who is not allowed to access it."

if testcase.security_flag and not access.can_user_access_testcase(testcase):
  raise helpers.AccessDeniedError()

The check is deliberately scoped to security_flag. access.can_user_access_testcase returns false for any anonymous caller, so gating every testcase on it would break the anonymous redirects this handler exists to provide (crbug.com/665652). Testcases that are not security-confidential keep redirecting exactly as before.

Reported through Google Bug Hunters (issue 561678864). It was assessed as defense-in-depth rather than a tracked security bug, and the Bug Hunters team asked me to submit the fix here as a pull request.

Tests

Two cases added to the existing issue_redirector_test.py: a security testcase without access, asserting the response never carries the issue id in the Location header or the body, and a security testcase with access, asserting the redirect still works. The first fails without the handler change and passes with it.

Running that file locally gives 3 passed and 1 failed, where the failure is test_no_issue_url, which already fails the same way on an unmodified checkout in my environment. I could not stand up the full butler.py py_unittest toolchain (asdf + Python 3.11 + pipenv) on this machine, so I ran the file directly under pytest with CONFIG_DIR_OVERRIDE=./configs/test; CI will be the real check.