refactor: use authorizationv2 EntityIdentifier helper constructors at existing construction sites

[coderabbitai]

Summary

PR #3232 introduced convenience constructors (ForToken, WithRequestToken, ForClientID, ForEmail, ForUserName) in the authorizationv2 package. This issue tracks replacing eligible inline EntityIdentifier struct literals across the codebase with calls to these helpers.

Background

Raised in PR #3232 review comment: #3232 (comment)

Requested by: @marythought

Candidate sites (directly replaceable)

WithRequestToken()

• service/authorization/v2/authorization_test.go — any site constructing EntityIdentifier_WithRequestToken{WithRequestToken: wrapperspb.Bool(true)} can be replaced with authzV2.WithRequestToken()

Sites that are NOT directly replaceable by current helpers

The following sites use proto fields not covered by the current helpers and should be left as-is (or addressed in a separate effort if new helpers are added):

• service/kas/access/accessPdp.go (Lines 95–97 and 112–114): passes an existing *entity.Token object (not a raw JWT string), so ForToken(jwt string) does not substitute directly.
• tests-bdd/cukes/steps_obligations.go and tests-bdd/cukes/steps_authorization.go: pass a fully-constructed *entity.EntityChain object with multiple entities; no current helper covers this pattern.
• service/authorization/v2/authorization_test.go (majority of sites): use EphemeralId on entity.Token or entity.EntityChain, which is not exposed by any current helper.
• examples/cmd/benchmark_decision_v2.go: uses entity.EntityChain{EphemeralId: ...}.

Acceptance Criteria

• Replace eligible WithRequestToken inline constructions in service/authorization/v2/authorization_test.go with authzV2.WithRequestToken()
• Consider whether the service/kas/access/accessPdp.go pattern warrants a new overload (e.g., accepting a *entity.Token directly) — if so, add helper and refactor
• Leave EphemeralId-based test constructions as-is (test-only ephemeral identifiers are unlikely to need a public helper)