Protect testcase task-log downloads

[M0nd0R]

This change protects /testcase-detail/task-log by enforcing testcase access checks before returning log content.

It also escapes task log filter values before building the Cloud Logging query so user-controlled task parameters cannot alter the intended filter.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[ViniciustCosta]

/gcbrun

[M0nd0R]

Updated this branch with the latest master and addressed the two concrete CI failures seen on the previous head:

• basic tests: fixed the task-log handler follow-up formatting/lint issues
• Kubernetes e2e: switched the bootstrap requirement export calls to use pipenv directly with stderr surfaced, and changed the e2e setup to pipenv sync --dev so CI uses the lockfile instead of relocking

I also verified locally that the task-log filter export commands now succeed, and I checked google/oss-fuzz for a matching source-side dependency on this handler path; there is no direct /testcase-detail/task-log or TaskLogHandler usage there that needs a paired patch.

The new GitHub Actions runs for head e21aa24d21f9df67c90b1748178afb2f77b55d3d are currently awaiting maintainer approval, and the Cloud Build checks will also need a collaborator to rerun /gcbrun for this updated head.

[decoNR]

/gcbrun