fix per-group authz and proxy protocol parsing

[novatechflow]

Summary

Fixes per‑group authorization semantics for DescribeGroups/DeleteGroups, accepts PROXY v1 UNKNOWN as valid, and adds targeted tests for mixed allow/deny and PROXY protocol parsing. Also adds a small integration-style ACL test that uses proxy‑derived principals.

Changes

• Per‑group authz: DescribeGroups/DeleteGroups now evaluate each group independently and return mixed results instead of all‑or‑nothing.
• PROXY v1 UNKNOWN: Treated as valid (local/no identity) rather than malformed.
• Tests:
  • Mixed allow/deny for DescribeGroups + DeleteGroups.
  • PROXY v1 UNKNOWN + PROXY v2 LOCAL parsing.
  • ACL allow via proxy‑derived principal for Produce.

Tests

• go test ./cmd/broker -run ACL
• go test ./pkg/broker -run ProxyProtocol
• make test-acl (runs KAFSCALE_E2E=1 go test -tags=e2e ./test/e2e -run TestACLsE2E)

Notes

• PROXY v2 LOCAL connections are accepted with no identity; ensure LB health checks don’t rely on ACL‑protected operations.