Course Optimizer endpoints ignore authz permissions #455

Description

The Course Optimizer endpoints still rely on the legacy authorization system (course roles), while the frontend already validates access to the tool using authz permissions (course content edit permission). This creates an inconsistency: the menu may show the tool as available, but the endpoint calls fail for users who only hold authz roles.

Current Behavior

The four Course Optimizer endpoints (link_check, link_check_status, rerun_link_update, rerun_link_update_status) validate permissions using Studio's legacy role system. A user with an authz course editor role (but no legacy role and not global staff) cannot use the tool: requests return 403 Forbidden even though the frontend lets them attempt it.

Expected Behavior

The endpoints should validate the authz courses.edit_course_content permission, so that any role (authz or legacy) granting that permission allows use of the Course Optimizer. A user with an authz editor role should be able to start a scan and check/update results without getting a 403.

Steps to Reproduce

1. Create a test course and turn on the contentstore.enable_course_optimizer flag (Force On) for that course.
2. Turn on authz for the same course (authz.enable_course_authoring, Force On).
3. Create a user who is not global staff and has no legacy course roles, and assign them an authz course editor role.
4. Log in to the authoring MFE as that user and open the course.
5. Go to Tools → Course Optimizer and try to start a scan (POST /api/contentstore/v0/link_check/<course_id>).
6. Observe that the request returns 403, even though the user has edit permission via authz.