Security: Protect annotation attempt answers - refs GHSA-8j57-5cjh-7pvj

[christianbeeznest]

Protects the annotation answer endpoint against unauthenticated and unauthorized access.

The endpoint now:

• requires an authenticated user before returning annotation data;
• validates that the attempt belongs to the requested course;
• allows the attempt owner and legitimate course/session review roles;
• validates that the requested question belongs to the exact quiz attempt;
• preserves the staff preview flow for exe_id=0 with explicit authorization.

Verification:

• anonymous request returns HTTP 403 with {"error":"access_denied"}
• PHP lint passed
• git diff --check passed

Refs GHSA-8j57-5cjh-7pvj