fix: allow signer thumbnail access and prefer file_id preview URLs

[vitormattos]

Problem

Signers with access to a document could not always load its thumbnail in LibreSign.

What changed

• Allowed thumbnail access for users who can sign the document, not only for the owner.
• Centralized thumbnail endpoint access validation in the backend.
• Updated preview URLs to prefer the LibreSign file_id thumbnail endpoint, with nodeId as fallback.
• Updated backend and frontend regression coverage.

Close #7537

[vitormattos]

/backport to stable33

[vitormattos]

/backport to stable32

[backportbot-libresign]

The backport to stable32 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable32
git pull origin stable32

# Create the new backport branch
git checkout -b backport/7539/stable32

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick f85c0e07 e8366a37 a5bb60ef 473e9bc9 a9b46aa7 2b6924e7 aae65949 964ac855 669d47cb 2907f6a6 abb8b477 21d10fc8 1a97e737 6635d3af 0d4d3d93

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/7539/stable32

Error: Failed to push branch backport/7539/stable32: remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/LibreSign/libresign.git/'

---

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.

[backportbot-libresign]

The backport to stable33 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable33
git pull origin stable33

# Create the new backport branch
git checkout -b backport/7539/stable33

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts, resolve them
git cherry-pick f85c0e07 e8366a37 a5bb60ef 473e9bc9 a9b46aa7 2b6924e7 aae65949 964ac855 669d47cb 2907f6a6 abb8b477 21d10fc8 1a97e737 6635d3af 0d4d3d93

# Push the cherry pick commit to the remote repository and open a pull request
git push origin backport/7539/stable33

Error: Failed to push branch backport/7539/stable33: To https://github.com/LibreSign/libresign.git
! [remote rejected] backport/7539/stable33 -> backport/7539/stable33 (refusing to allow a GitHub App to create or update workflow .github/workflows/behat-mariadb.yml without workflows permission)
error: failed to push some refs to 'https://github.com/LibreSign/libresign.git'

---

Learn more about backports at https://docs.nextcloud.com/server/stable/go.php?to=developer-backports.