fix: check a move's writes with the rights its token carries in the target

The transfer re-authenticated the token against the target but then checked
writes with the user's database membership there, so a JWT whose claims are
narrower than that membership could copy a draft to a path it cannot save to
directly. The identity the re-authentication returns is now the one the
checks and the copy use.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/windmill-api-workspaces/src/workspaces.rs

@@ -14244,7 +14244,7 @@ async fn seed_full_diff_scan(
 /// If the user is not a member of `workspace_id`, returns an authed with no
 /// folders/groups/operator/admin (except for superadmins, who stay admin) —
 /// i.e. they will only see what RLS explicitly allows for unknown users.
-pub async fn load_workspace_authed(
+async fn load_workspace_authed(
     db: &DB,
     base_authed: &ApiAuthed,
     workspace_id: &str,