feat(hydra): filter hydra:operation by operation security, add collection support

[schmunk42]

Closes #5

What

• Security filtering: each operation advertised in hydra:operation is now checked against the current token via API Platform's ResourceAccessChecker; operations whose security expression denies access are omitted. Operations without a security expression stay visible (default: allowed). Item operations are evaluated with the loaded entity as object; evaluation errors fail closed.
• Collection support: collection GET responses (hydra:Collection) now also get a hydra:operation array with the security-filtered collection-level operations (create POST + custom collection actions). One check per operation — no per-member evaluation.
• Config flag: hydra_operations.filter_operations_by_security (default true) restores the previous unfiltered behavior when set to false.
• HTTP caching: Vary: Authorization is emitted while filtering is active, since the advertised operations are user-dependent. The static /docs.jsonld is untouched.
• Graceful degradation: without symfony/security-bundle the checker service is absent (optional reference) and filtering is skipped.
• Incidental fix: duplicate partial_uuid_item_provider node in the configuration tree.

Tests

12 new PHPUnit tests covering: denied vs. granted token on item and collection responses, operations without security expression staying visible, object context propagation, disabled flag, missing checker, Vary header, id substitution. Full suite: 24 tests, 57 assertions, green.

Verified manually against a local API Platform 4.3 / Symfony 7.4 stack with two Keycloak users (with/without the admin role): item response shrinks to GET only, collection response loses POST + custom actions for the unprivileged user; /docs.jsonld stays byte-identical across tokens.

🤖 Generated with Claude Code