Authenticated trace disclosure and tampering via missing validators

Improper access control in MLflow before 3.14.0 allows remote authenticated users to read, modify, or delete unauthorized traces. The _before_request handler omits trace routes from its validator map, so requests bypass experiment-level read, update, and delete permission checks. Authentication must be enabled and any valid account is sufficient; the bypass exposes trace contents and permits tampering with or deleting trace and audit data.