Remove unused resource parameter from getPermissionsFor

[NaderMohamed325]

What

Removes the unused resource parameter from getPermissionsFor in lib/header.js.

Why

resource is passed into getPermissionsFor but never used inside the function body —
acl.can(user, mode) doesn't take a resource argument. As confirmed in #973, the
resource is already implicit in the acl object itself (scoped via
ACLChecker.createFromLDPAndRequest, see lib/acl-checker.js), so passing resource
again here is dead code.

Closes #973

Testing

Ran the full test suite locally on Windows. 4 pre-existing failures unrelated to this
change (CRLF/LF line-ending mismatches in OIDC integration tests, and a signup page
timeout) — confirmed these fail identically with this change stashed out.

[Copilot]

Pull request overview

Removes an unused parameter from the internal getPermissionsFor helper used to populate the WAC-Allow response header, relying on the acl instance to already be scoped to the requested resource.

Changes:

• Removed the unused req/resource-related parameter from getPermissionsFor.
• Updated addPermissions to call getPermissionsFor with the simplified signature.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[NaderMohamed325]

Hi @bourgeoa / @kjetilk / @RubenVerborgh — this addresses #973 that one of you
already confirmed. Happy to make any changes if needed, just flagging in case
it fell off the radar.