Filter the topology history by the authenticated caller rather than the requested user name

[rzo1]

Two problems on getTopologyHistory: it performed no authorization check at all, and the identity used for filtering was the caller-supplied user argument rather than the authenticated principal. isAdmin was computed as adminUsers.contains(user), and the visibility test failed open on user == null, so a direct Thrift caller could pass null and receive every assigned topology. readTopologyHistory repeated the same fail-open over the on-disk history.

The call is now authorized like its neighbours, and the effective user comes from ReqContext mapped through the configured IPrincipalToLocal. An admin caller may still name a different user, which is how the UI serves /history/summary on behalf of its web users.

A caller that is not an admin and names somebody else gets its own history back, with a WARN naming the principal and nimbus.admins, rather than an error. That keeps the page working on a cluster whose UI principal was left out of nimbus.admins (docs/SECURITY.md already recommends adding it) instead of failing the request.

Extends NimbusTest.