Fixed: find tran coordinator was not ACL verified

[dlex]

Cover letter

The code to handle FindCoordinator request for transaction coordinator type
appeared before the caller is checked for authorization for this operation
against the ACL. That allowed execution of find_coordinator(transaction)
by a client that does not have the describe access to the transactional-id.

The check has now been moved before any other handling.

Release notes

• none

[CLAassistant]

All committers have signed the CLA.

[dotnwat]

nice catch.

do you think it would be possible to add a test for this around here: https://github.com/redpanda-data/redpanda/blob/dev/tests/rptest/tests/acls_test.py#L162

[dlex]

do you think it would be possible to add a test for this around here: https://github.com/redpanda-data/redpanda/blob/dev/tests/rptest/tests/acls_test.py#L162

I don't think so. To my knowledge, there is no kafka client function to issue FindCoordinator(txn) request alone, it is always followed by another txn related request (like InitProducerId) which would be properly verified against ACLs. So unless there is a way to issue raw kafka API requests from ducktape tests, there is no way to isolate this bug with a test.