update REST transport bridge and xt tests for v3 authz

REST.pm gets error code mapping from v3's response body (error_code /
error_msg), delegation oid remapping, boolean coercion, permission
flattening in login responses, and delegation supplement handling.

xt tests adjusted to work with v3's centralized permission enforcement --
14_permissions.t and 20_permission.t both pass (4892/4892).

Companion to NicTool/api#48.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: burning-bush-dev