Authenticated permission-ticket disclosure via missing role check

Improper access control in Red Hat build of Keycloak 26.4 allows remote authenticated users to enumerate UMA permission tickets. ProtectionService creates the permission-ticket handler without enabling its uma_protection scope check, so the store query returns tickets outside the caller's ownership. Exploitation requires a valid user token for a resource-server client that lacks the uma_protection role; disclosed tickets reveal permission-request records without enabling reported modification.