security: log instead of throwing when the auth result is unchecked

The throwing destructor cannot fail a request from a coroutine: the
throw escapes into a noexcept context and aborts the broker. Both users
now enforce the check elsewhere: the admin server authorizes eagerly at
dispatch, and Schema Registry verifies deferred checks in wrap, so the
destructor keeps only the log.