Security: enforce API key auth precedence

[badgerops-cortana-bot]

Summary

• Make bearer API keys take precedence over session cookies in dual auth
• Keep CSRF enforcement for state-changing requests that mix a session cookie with a cpam_ bearer-style Authorization header
• Add regression coverage for API-key/session credential mixing and CSRF bypass behavior
• Add 0.17.4 security changelog entry

Verification

• go test ./internal/api
• go test ./...
• git diff --check

Notes

• make lint could not run because golangci-lint is not installed in this environment.