refactor(plugin-security): move SecurityPlugin's leaf readers into security-plugin-object-inputs.ts (wip)

The bodies of sixteen private methods (the RLS policy collection and its
admission, the unresolved-posture probes, the field-level masks and
required-permission folds, the field-name tables) move unedited, re-indented
one level, with isDelegatedPrincipalLeg, which only they read. The class
keeps every method, its signature and docblock, and hands each body a host
literal of exactly the members it reads.

Claude-Session: https://claude.ai/code/session_017BoLT8Gaa8t9a7AWVH8qZa
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude