security(authz): gate mark_revoked on ALLOW_USER_OFFBOARD, not the read perm (F-006)

mark_revoked performs a destructive cross-user access revocation but was gated
only by @user_with_permission(["VIEW_USER_ACCESS_LIST"]) — a read permission.
Any holder of that read perm could revoke any user's access (CTO-4858, CVSS 8.1
IDOR). Switch to ALLOW_USER_OFFBOARD, the permission already used to authorize
revocation/offboarding elsewhere (group_helper.revoke_access_from_group,
models User.offboard). The read view all_user_access_list keeps VIEW_USER_ACCESS_LIST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: KrishnaSuravarapu

Access/views.py

@@ -575,7 +575,7 @@ def all_user_access_list(request, load_ui=True):
 
 
 @login_required
-@user_with_permission(["VIEW_USER_ACCESS_LIST"])
+@user_with_permission(["ALLOW_USER_OFFBOARD"])
 def mark_revoked(request):
     """Revoke an access