fix: A draft site no longer opens to a user whose name ends its owner's EXO-91427 - #1356

EXO-91427 (#1345)

**Symptom**: a user whose username ends another user's after an `_`
(`john` for `doe_john`) could open that user's draft site
(`<type>_<name>_draft_doe_john`), at its URL and in the site layout
editor, and change or delete it.

**Cause**: the `DRAFT` branches of `UserACL#hasEditPermission` and
`UserACL#hasAccessPermission(…, Stream)` granted a draft site whose name
ended with `"_" + userId`. Usernames admit `_` and so do site names, so
a draft's name does not tell its owner: `john`'s draft of a site named
`team_draft` and `draft_john`'s draft of `team` are both
`portal_team_draft_draft_john`.

**Fix**: every suffix following a `_draft_` of the name is a candidate
owner. The identity is granted the draft only when it is one of them and
no other candidate is an existing user (`UserHandler#findUserByName(…,
UserStatus.ANY)`). A candidate the user store cannot check refuses the
draft, and a name holding a single `_draft_` needs no lookup.
Administrators keep their access to every draft. `UserACLTest` pins the
owner, the suffix user with the owner existing and deleted, a site
manager of the drafted site, both ambiguous cases, a failed lookup, an
administrator and an anonymous caller.

Meeds-io/layout#590 refuses to create a draft whose name another
existing user could own, and removes a deleted user's draft sites. Until
it is merged, and for users deleted before it, a draft whose other
candidate owner was deleted is granted to the remaining one, as it was
before this change. Merge this PR first: #590's check relies on this
rule.

Knowledge: Meeds-io/eng-standards#522

This change is classified N1 (ACL and identity resolution in `UserACL`):
its approver must be an Archi/Dev who knows it is N1, not an approval on
AI review alone, and author ≠ approver.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
(cherry picked from commit 3fd575f)