feat(collaboration): add UserExtraInfo with avatar and mail to CheckFileInfo

Add UserExtraInfo (avatar + mail) to the WOPI CheckFileInfo response for
authenticated, non-public-share users.

UserExtraInfo format (per Collabora SDK):
https://sdk.collaboraonline.com/docs/advanced_integration.html#userextrainfo

```json
{
  "avatar": "http://url/to/user/avatar",
  "mail": "user@server.com"
}
```

After this change, CheckFileInfo returns:

```json
{
  "BaseFileName": "Pedro-filled-hazcom.docx",
  "UserFriendlyName": "Admin",
  "UserId": "346364...39323030",
  "UserCanWrite": true,
  "UserCanRename": true,
  "IsAdminUser": true,
  "EnableInsertRemoteImage": true,
  "EnableInsertRemoteFile": true,
  "EnableOwnerTermination": true,
  "UserExtraInfo": {
    "avatar": "https://host:9300/wopi/avatars/{userID}?access_token={wopiToken}",
    "mail": "admin@example.org"
  },
  "PostMessageOrigin": "https://localhost:9200",
  "message": "CheckFileInfo: success"
}
```

Avatars are served via a new /wopi/avatars/{userID} endpoint on the
collaboration service, authenticated by the WOPI token. The endpoint
calls the Graph service directly (bypassing the proxy) using the reva
access token via x-access-token header.

All tests pass:
go test ./services/collaboration/... ./services/graph/... ./services/proxy/...

Signed-off-by: Pedro Pinto Silva <pedro.silva@collabora.com>

services/collaboration/pkg/server/http/server.go

@@ -194,5 +194,20 @@ func prepareRoutes(r *chi.Mux, options Options) {
 				adapter.GetFile(w, r)
 			})
 		})
+
+		// Avatar proxy: serves user avatars authenticated by the WOPI token.
+		// Collabora loads avatars via img.src (plain GET, no auth headers),
+		// so the token must be in the URL query string.
+		r.Route("/avatars/{userID}", func(r chi.Router) {
+			r.Use(
+				func(h stdhttp.Handler) stdhttp.Handler {
+					return colabmiddleware.WopiContextAuthMiddleware(options.Config, options.Store, h)
+				},
+				colabmiddleware.CollaborationTracingMiddleware,
+			)
+			r.Get("/", func(w stdhttp.ResponseWriter, r *stdhttp.Request) {
+				adapter.GetAvatar(w, r)
+			})
+		})
 	})
 }