Use API key owner for permission checks instead of current user in shurly_service

Problem/Motivation

shurly_service generates a per-user API key but the access check and permission logic in DefaultController loads currentUser() instead of the user resolved from that key.

This makes the API unusable for unauthenticated (sessionless) clients — e.g. scripts or external tools — even when a valid API key is provided, defeating the purpose of per-user keys entirely.

Steps to reproduce

Call /shurly/api/shorten?apiKey=<valid-key>&longUrl=<url> without an active Drupal session. Access is denied despite the key being valid.

Proposed resolution

In the access check and permission evaluation, resolve the account from the provided apiKey parameter and use that account for all permission checks, consistent with how shurly_shorten() already handles it internally.

Remaining tasks

Patch DefaultController::shurly_service_access_api_key() and update the shorten/expand methods to use the API key-resolved account throughout.

User interface changes

None.

API changes

None. Existing request format is unchanged.

Data model changes

None.