[Bug]: Statistics APIs miss RBAC permission checks

[shaoting-huang]

Is there an existing issue for this?

• I have searched the existing issues

Environment

• Milvus version: master before milvus-proto v3.0.0-20260806081414-16b288837fbd
• Deployment mode(standalone or cluster): standalone or cluster
• MQ type(rocksmq, pulsar or kafka): N/A
• SDK version(e.g. pymilvus v2.0.0rc2): N/A
• OS(Ubuntu or CentOS): N/A
• CPU/Memory: N/A
• GPU: N/A
• Others: Authorization/RBAC enabled

Current Behavior

GetCollectionStatistics and GetPartitionStatistics requests are not protected by the PrivilegeGetStatistics RBAC privilege because the generated proto/API metadata does not include the privilege annotation for these statistics APIs.

As a result, an authenticated principal without PrivilegeGetStatistics can pass the privilege interceptor for collection and partition statistics requests.

Expected Behavior

When authorization is enabled, GetCollectionStatistics and GetPartitionStatistics should require PrivilegeGetStatistics on the target collection. Users without this privilege should receive a permission denied error, and users with the privilege should be allowed.

Steps To Reproduce

1. Enable authorization.
2. Create or use a non-root user with a role on a collection.
3. Grant the role a collection privilege such as Load, but do not grant GetStatistics.
4. Call GetCollectionStatistics or GetPartitionStatistics for that collection.
5. The request is allowed instead of being denied by RBAC.

Milvus Log

N/A

Anything else?

Fixed by #52248.