Require job access in revisions_info before disclosing component revisions

[herdiyana256]

revisions_info reads a job name from the request and returns that job's component revision list, decorated only with @handler.oauth and with no job-access check:

job_type = request.get('job')
# ... straight to resolving the component/revision list, no authorization

The result is per-job build data (the source components, their repo git URLs, and the revisions between two builds), so it should be gated on job access the way coverage_report and fuzzer_stats are. @handler.oauth authenticates the caller but does not authorize an arbitrary job, so without a check any caller could disclose the build composition of a job, and its project, they cannot otherwise access.

from libs import access
from clusterfuzz._internal.datastore import data_types

def get_component_revisions_list(job_type, revision, revision_range):
  if not job_type:
    raise helpers.EarlyExitError('Job name cannot be empty.', 400)
  if not data_types.Job.VALID_NAME_REGEX.match(job_type):
    raise helpers.EarlyExitError('Invalid job name.', 400)
  if not access.has_access(job_type=job_type):
    raise helpers.AccessDeniedError()
  ...

The logic is refactored into get_component_revisions_list, which validates the job name and requires job access before disclosing anything. Adds a regression test for the access-denied path.