Require essentials.whois.location to view coordinates in /whois

[zzzzzyc]

Fixes the information disclosure half of #6626: /whois sent exact player coordinates to anyone holding essentials.whois. A new essentials.whois.location node now guards the location line, matching the existing essentials.seen.location design. Console and non-player senders are unaffected.

Information

This PR partially addresses #6626.

Details

Proposed fix:
Guard the whoisLocation line in Commandwhois behind a new essentials.whois.location permission node (registered in plugin.yml), matching the existing essentials.seen.location design. Behaviour note: players with essentials.whois previously saw coordinates by default; after this change they need the new node. Console and non-player senders are unaffected (CommandSource.isAuthorized auto-allows them).

The cooldown-bypass half of #6626 (AsyncTeleport.cooldownApplies()) is intentionally left out and will follow as a separate PR.

Environments tested:

OS: Windows 11 25H2

Java version: 26.0.1 (server ran on Paper's bundled Java 25 runtime path; built with Temurin 25.0.4.1)

• Most recent Paper version (XX.YY.Z, git-Paper-BUILD)
• CraftBukkit/Spigot/Paper 1.12.2
• CraftBukkit 1.8.8

Demonstration:

Live-server repro via two bots (Victim, Tester) + LuckPerms, teleport-cooldown: 10, EssentialsX 2.22.1-dev+24-49a2f10 (unpatched) vs this branch (patched):

Before (unpatched) — Tester holds only essentials.whois, runs /whois Victim (victim at 120.5, 67, -458.5):
- 坐标：(world，120, 67, -459) ← leak confirmed

After (patched) — same setup, location line hidden; then granting essentials.whois.location:
- 坐标：(world，200, 68, 300) ← node restores it, Victim2 at 200, 68, 300

Negative control: clearing all Tester permissions → /whois denied (你没有使用该命令的权限), ruling out OP/config contamination. Full repro steps in my comment on #6626.