Post-revocation stream access via retained authorization

Insufficient session expiration in GitLab CE/EE allows remote authenticated users to access streaming results after token revocation. A long-lived streaming endpoint keeps an established connection authorized instead of invalidating its token when that token is revoked. The attacker must first obtain a valid low-privilege token and maintain the connection; stale authorization then exposes streaming results after access should end.