Fix low BAC profile authorization

[r1kka6]

Summary

• authorize low BAC profile access with the authenticated server-side user ID instead of the attacker-controlled user_id cookie
• keep the role banner server-derived so forged user_role cookies do not change displayed authorization context

Verification

• docker run --rm -v "$PWD":/work -w /work php:8.3-cli php -l vulnerabilities/bac/source/low.php
• vulnerable baseline discloses user 2 profile when user_id=2 is supplied in both the query and cookie
• patched runtime denies forged user_id=2 for an authenticated admin session and still allows the admin user to view user_id=1