Validate channel metadata authorization (7.3.0 backport)

[holmesworcester]

Summary

• backport channel metadata authorization checks to the 7.3.0 release branch
• reject forged private-channel metadata encrypted to broad roles or team scope
• reject public-channel metadata that reuses an existing private channel id
• add focused channel metadata validation tests

Validation

• npm run lint:no-fix -- src/nest/storage/channels/channels.service.ts src/nest/storage/channels/channels.service.spec.ts
• npm run build -- --pretty false
• NODE_OPTIONS="--experimental-vm-modules" DEBUG= npx -y node@20.20.1 node_modules/jest/bin/jest.js --runInBand --verbose --testPathIgnorePatterns=".src/(!?nodeTest*)|(.node_modules*)" --detectOpenHandles --forceExit src/nest/storage/channels/channels.service.spec.ts

Backport of the channel metadata validation fix in #3306.