fix: sec002 and sec009

[lorenzo-ranciaffi]

Pull Request Description

Related PRs:

• feat: add spawn px scene permission schemas#436

What does this PR change?

This PR addresses the findings in SEC-002 and SEC-009 by making sure that if a scene wants to spawn a portable experience it is required to state SPAWN_PORTABLE_EXPERIENCE in the required permissions.
If such portable experience requires any authorization (like for Smart Wearables), a confirmation popup is presented to the user before running it so they can consent/deny the action. The action is cached for such PX in the session so the user is not prompted every time.

On top of that, a new panel summarizing the currently running PXs (Global, Local and Smart Wearables) has been added so the user is in control of their lifecycle: they have the ability to kill Local PXs and Smart Wearables from there.

Prerequisites

• Launch the build with arg dclenv zone

Test Steps

1. Go to 9,49
2. Click the cube to spawn a local PX
3. Verify there's a popup asking you for confirmation
   • if you accept:
     • verify the PX runs (middle right of the screen has a popup that opens a link to google.com)
     • you can see and kill the px from the new panel
     • if you kill the px you can restart it from the cube, note no auth is requested
   • if you reject:
     • the px will not run
     • if you try to spawn it again by clicking the cube, no auth screen will be prompted and the px won't run
4. If you relaunch the client, the previous choices will be reset and the whole flow starts again from scratch
5. Test that from the new panel you can kill local px (as stated above) and unequip smart wearables

Quality Checklist

• Changes have been tested locally
• Documentation has been updated (if required)
• Performance impact has been considered
• For SDK features: Test scene is included

Code Review Reference

Please review our Branch & PR Standards before submitting. It explains the automated review flow, QA/DEV approval requirements, and what each label does — especially useful for first-time contributors.

[github-actions]

Build skipped — no changes detected under Explorer/.

[github-actions]

Lint ratchet not evaluated for this run.