Fix ApplyPolicy.Validation not enforced on code-first fields

[glen-84]

Summary

• Code-first .Authorize(ApplyPolicy.Validation) on a field never enforced the policy: unauthenticated requests resolved the protected field, while the annotation-based [Authorize(Apply = ApplyPolicy.Validation)] correctly rejected them.
• Regression from the ContextData → Features migration (Introduced new execution abstractions. #8267): the code-first extension wrote the AuthorizeAtRequestLevel marker to the field configuration's features (which nothing reads) instead of the descriptor context. The attribute and SDL paths write it to the descriptor context, where the AuthorizationTypeInterceptor reads it to flag the schema for request-level enforcement.
• Both AuthorizeAtRequestLevel writes in AuthorizeObjectFieldDescriptorExtensions now target descriptor.Extend().Context, matching AuthorizeAttribute. The AllowAnonymous write is unchanged (it correctly lives on the field configuration).

Test plan

• Added Authorize_Field_Validation_NoAccess_When_Type_Not_Authorized, which isolates a field-level validation policy on an otherwise-unauthorized query type (the case existing tests masked via a type-level policy). Verified it fails on the old code and passes on the fix.
• dotnet test for HotChocolate.Authorization.Tests (33/33) and HotChocolate.AspNetCore.Authorization.Tests (110/110), green on net8.0/net9.0/net10.0.

Closes #9830

[Copilot]

Pull request overview

Fixes a regression where code-first field authorization configured with ApplyPolicy.Validation did not trigger request-level authorization enforcement (allowing unauthenticated requests to resolve protected fields), restoring parity with attribute-based and SDL-based authorization configuration.

Changes:

• Write the AuthorizeAtRequestLevel marker to descriptor.Extend().Context.Features for code-first fields configured with ApplyPolicy.Validation, matching the attribute/SDL paths so AuthorizationTypeInterceptor can flag the schema correctly.
• Add a targeted test covering the scenario where only a field (not the containing query type) carries a validation policy, ensuring request-level enforcement is activated.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/HotChocolate/Core/src/Authorization/Extensions/AuthorizeObjectFieldDescriptorExtensions.cs	Fixes the feature write location so request-level validation auth is correctly enabled for code-first fields.
src/HotChocolate/Core/test/Authorization.Tests/CodeFirstAuthorizationTests.cs	Adds a regression test that fails pre-fix and passes with the corrected marker propagation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.