Resolve grants accessible to a user

Returns the list of active grants the user identified by crn and sbi is permitted to access.

The user's identity is supplied in the x-user-context header as a JWT containing crn and sbi claims. The JWT is signed by the calling service using the shared ENCRYPTED_AUTH_JWT_SECRET.

Access rules (evaluated per environment):

• Grants with no allowlist entries are closed to all users.
• Grants with allowAll: true in their allowlist.yaml are open to all users.
• Otherwise the user must appear in both the CRN and SBI lists.

The allowlist.yaml format (per environment, per grant config):

dev:
  allowAll: true
test:
  crns:
    - '1234567890'
  sbis:
    - '123456789'