Backport

This PR is auto-generated from #19138 to be assessed for backporting due to the inclusion of the label backport/1.13.x.

The below text is copied from the body of the original PR.

This checks the request against the read permission for sys/events/subscribe/{eventType} on the initial subscribe.

Future work includes moving this to its own verb (subscribe) and periodically rechecking the request.

Tested locally by minting a token with the wrong permissions and verifying that they are rejected as expected, and that they work if the policy is adjusted to sys/event/subscribe/* (or the specific topic name) with read permissions.

I had to change the core.checkToken() to be publicly accessible, as it seems like the easiest way to check the token on the logical.Request against all relevant policies, but without going into all of the complex logic further in handleLogical().