Add tool: set ORIGINAL bundle resource policies by handle

[milanmajchrak]

Problem description

We need to (re)set resource policies on the ORIGINAL bundle of specific items, addressed by handle — e.g. to embargo original files (admin-only) or to make them anonymously readable with no start date. The existing tools/policy_and_auth/policy.py works per community (by UUID), not per handle.

What this adds

A new self-contained tool tools/set_original_policies/:

• Resolves each handle to an item UUID via /api/pid/find, falling back to the discovery search API.
• Finds the item's ORIGINAL bundle and (optionally) its bitstreams.
• For a chosen action (default READ): deletes the existing policies for that action and creates a single policy granting it to a configurable group (name or UUID, default Administrator).

Configurable (vs. Administrator/READ-only)

• --group — group name or UUID (default Administrator).
• --action — READ (default) / WRITE / ADD / REMOVE / DELETE / ADMIN.
• --apply-to — bundle, bitstreams, or both (default bundle).

Authentication (DSpace 7/8 Bearer-JWT)

Same flow as PR #264 — GET /api/security/csrf → POST /api/authn/login → Authorization: Bearer <jwt> + X-XSRF-TOKEN on every request. Two modes:

• credential login (--email, password via --password / DSPACE_PASSWORD / prompt), or
• a pre-obtained --bearer-token (or DSPACE_BEARER_TOKEN) — login is skipped and logout is not called so the supplied token stays valid.

Other

• Handle input via --handles (CSV), repeated --handle, or --handles-file (one per line, # comments); de-duplicated.
• --dry-run, explicit --timeout-sec, --retry-count, --retry-backoff-sec with exponential backoff, --continue-on-bitstream-error, --log-file.
• Non-zero exit code if any handle/bitstream update fails.

Relationship to #264

This generalises the replace_resource_policies tool from #264 (which is Administrator/READ-only): configurable group + action, bundle-only option, file handle input, and direct Bearer-token auth. It is fully standalone (depends only on requests, imports nothing from src/).

Testing

• python -m py_compile clean; --help renders.
• Unit-level checks of handle parsing (CSV/file/# comments), de-duplication, and group UUID-vs-name detection.
• Auth-arg validation and the --bearer-token branch verified locally (skips login, goes straight to CSRF).
• ⚠️ Not yet exercised end-to-end against a live DSpace instance — please run with --dry-run first.

🤖 Generated with Claude Code