KAFKA-14605: Change audit log level in StandardAuthorizer

[hulincup]

What changes were proposed in this pull request?

Change the audit log level in StandardAuthorizerData:

• ALLOWED operations: DEBUG → INFO (when logIfAllowed is set)
• DENIED operations: INFO → WARN (when logIfDenied is set)

Why are the changes needed?

Audit logs are security-critical and should be visible at default log levels.

Currently:

• ALLOWED operations are logged at DEBUG level - too verbose, requires DEBUG logging to see
• DENIED operations are logged at INFO level - not prominent enough for security events

After this change:

• ALLOWED operations logged at INFO level - visible in default configuration
• DENIED operations logged at WARN level - stands out as security events

Did this PR include tests?

Yes. Updated StandardAuthorizerTest:

• Stub isInfoEnabled() and isWarnEnabled() for the new log levels
• Verify info() for ALLOWED (was debug())
• Verify warn() for DENIED (was info())

Documentation

Updated docs/security/security-model.md to reflect the new log level contract:

• INFO logs allowed requests (was DEBUG)
• WARN logs denied requests (was INFO)

Performance Considerations

The default log4j2.yaml sets kafka.authorizer.logger to INFO. After this change, ALLOWED operations will be logged by default on brokers with ACLs enabled. This increases audit visibility but also increases log volume. Operators who want the previous behavior can set the logger level to WARN.

Fixes: KAFKA-14605