feat: add @libre.graph.permissions.actions.allowedValues to driveItem

[dschmidt]

Summary

Adds an optional, $select-gated instance annotation on driveItem that carries the list of libre.graph actions the caller is allowed to perform on an item. Mirrors the annotation of the same name on the /permissions endpoint so clients can get the effective-actions view inline without a separate round-trip per item.

Motivated by the discussion on #34 (search endpoint) — a sharing dialog rendered over search / listing results shouldn't need to fan out one /permissions call per hit just to know what the caller can do with each result.

Changes

• Adds @libre.graph.permissions.actions.allowedValues to the driveItem schema, read-only, populated only when explicitly requested via $select.
• Extends the driveItemSelect component parameter (introduced by feat: Add @microsoft.graph.downloadUrl annotation and /content endpoi… #38) with the new enum value and a matching example.
• Wires driveItemSelect to every endpoint that returns a driveItem directly: GetDriveItem, GetRoot, HomeGetRoot, HomeGetChildren.

Only actions, not roles, for now — roles are a curated bundle concept primarily useful for building a sharing-role picker and can be added in a follow-up if needed. Actions carry the full-fidelity permission info, equivalent (at finer granularity) to the WebDAV short-string we already produce today in search results.

Notes on scope

• Share-listing endpoints (ListSharedByMe, ListSharedWithMe) are intentionally skipped. Their descriptions already promise that the permissions relation is always returned inline, so the opt-in allowedValues annotation would be redundant there.
• $select semantics here are narrower than OData's. The enum is constrained to specific opt-in instance annotations, and selecting a value adds it to the default response rather than restricting the response to only the selected fields. This matches the pattern established by feat: Add @microsoft.graph.downloadUrl annotation and /content endpoi… #38's driveItemSelect and the existing permissionsSelect parameter on /permissions. Spec consistency within libre-graph-api wins over strict OData fidelity for this case.
• Not on remoteItem. The outer driveItem is sufficient for the common sharedWithMe case because the mountpoint stat already carries the caller's effective permissions on the underlying resource. If that assumption breaks we can add it to remoteItem in a follow-up.

[micbar]

I like the idea!

This needs a rebase.

[dschmidt]

Rebased