permission: support URL and Uint8Array as has()/drop() reference

[nhjbest22]

process.permission.has()/drop() only accepted a string or Buffer for
the reference argument. This adds support for a WHATWG URL, resolved
via fileURLToPath() for fs.* scopes since those are the only scopes
that actually use the reference value, and a plain Uint8Array.

Also switches permission.cc from Utf8Value to BufferValue when reading
a Buffer/TypedArray reference, since Utf8Value forces a UTF-8 string
conversion that can silently corrupt a path that isn't valid UTF-8.

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[codecov]

Codecov Report

❌ Patch coverage is 90.69767% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.14%. Comparing base (cf30b2e) to head (42241f8).
⚠️ Report is 149 commits behind head on main.

Files with missing lines	Patch %	Lines
src/permission/permission.cc	72.72%	0 Missing and 3 partials ⚠️
lib/internal/process/permission.js	96.87%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65492      +/-   ##
==========================================
+ Coverage   90.11%   90.14%   +0.03%     
==========================================
  Files         752      751       -1     
  Lines      251861   252647     +786     
  Branches    47365    47549     +184     
==========================================
+ Hits       226955   227745     +790     
+ Misses      16238    16192      -46     
- Partials     8668     8710      +42     

Files with missing lines	Coverage Δ
lib/internal/process/permission.js	92.39% <96.87%> (+10.68%)	⬆️
src/permission/permission.cc	75.98% <72.72%> (+0.76%)	⬆️

... and 108 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76438/

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76452/

[MikeMcC399]

In repeat runs of Jenkins

https://ci.nodejs.org/job/node-test-pull-request/76438/
https://ci.nodejs.org/job/node-test-pull-request/76452/

alpine-last-latest-x64
failed once in
parallel/test_fastutf8stream_destroy/
and once in
parallel/test_fastutf8stream_reopen/

also in multiple
sea.test*

rhel8-x64
failed in both runs for multiple
sea.test* (24 failures)

This will need investigation.

Edit: #65554 describes and attempts to fix the flaky tests *fastutf8stream*

[MikeMcC399]

It looks like the sea failures are also occurring without this PR, so this would also be test flake.
See https://github.com/nodejs/reliability/blob/main/reports/2026-08-26.md

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76510/

[MikeMcC399]

@nhjbest22

The flaky tests were confusing the results. I've just started a completely new Jenkins CI run to see if we can get a green result.

In parallel there are other people looking at solving the flaky tests as these are having a general impact on processing PRs, not just yours.