Enforce authentication check on job status notification hook endpoints

Harbor Core provides webhook callback endpoints (such as /service/notifications/tasks/:id and legacy /service/notifications/jobs/* routes) to receive asynchronous job status update notifications from Jobservice. Currently, jobStatusHandler.ServeHTTP in src/server/handler/job_status_hook.go decodes the incoming JSON payload and immediately delegates processing to task.HookHandler.Handle() without verifying the caller's identity or authentication context:

func (j *jobStatusHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
    defer r.Body.Close()
    sc := &job.StatusChange{}
    if err := json.NewDecoder(r.Body).Decode(sc); err != nil {
        libhttp.SendError(w, err)
        return
    }
    if err := j.handler.Handle(r.Context(), sc); err != nil {
        libhttp.SendError(w, err)
        return
    }
}

Because there is no check verifying that the caller is an authenticated internal component (such as Jobservice presenting the shared secret), any request that reaches this endpoint can trigger task/execution status transitions and post-hooks without authentication.

Expected Behavior

Requests to the job status notification endpoints should be authenticated. The handler should verify that the caller is an internal solution user (e.g., Jobservice authenticated via the internal secret header) before processing the status change. Unauthenticated or non-solution callers should receive a 401 Unauthorized response.

Actual Behavior

The handler processes status changes directly without checking the request security context, accepting unauthenticated POST requests.