fix(rest): the /security routes answer from the request's environment kernel on a hosted runtime, so an owner can accept an installed app's default permission set (#30192)

fix(rest): the /security routes answer from the request's environment kernel on a hosted runtime, so an owner can accept an installed app's default permission set (#30192) #18296