docs: note that variable/resource perm errors show extra_perms on purpose (#12079)

* fix: drop extra_perms from variable and resource access-denied errors

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: pin that denied variable/resource reads omit extra_perms

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: note that perm errors show extra_perms on purpose

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

backend/windmill-store/src/resources.rs

@@ -695,6 +695,9 @@ async fn get_resource_value(
     Ok(Json(value))
 }
 
+/// Including the resource's and its folder's `extra_perms` in the error is intended, not a
+/// leak: who holds access to an item is not secret within a workspace, and it tells the
+/// denied caller whom to ask. Keep the maps in the message.
 pub async fn explain_resource_perm_error(
     path: &str,
     w_id: &str,

backend/windmill-store/src/variables.rs

@@ -486,6 +486,9 @@ fn describe_authed(authed: Option<&(impl Authable + Sync)>) -> String {
     }
 }
 
+/// Including the variable's and its folder's `extra_perms` in the error is intended, not a
+/// leak: who holds access to an item is not secret within a workspace, and it tells the
+/// denied caller whom to ask. Keep the maps in the message.
 async fn explain_variable_perm_error(
     path: &str,
     w_id: &str,