fix(sessions): drop the deny-NETWORK pipe ACE (#187)

NT AUTHORITY\NETWORK marks a network logon, not a remote caller. On windev
a gateway run from an SSH session carries it in its own token, so the deny
entry locked the gateway's same-machine workers out (UnauthorizedAccess on
connect; 15 fake-worker tests failed). The ACL now holds exactly one entry:
FullControl for the gateway's user.

src/ZB.MOM.WW.MxGateway.Server/Sessions/WorkerPipeSecurity.cs

@@ -10,8 +10,13 @@ namespace ZB.MOM.WW.MxGateway.Server.Sessions;
 /// credential-bearing commands (secured writes, <c>AuthenticateUser</c>, alarm-ack passwords), so
 /// its unguessable name is not enough: only the account the gateway runs as — which is also the
 /// account the worker is launched as, because the launcher sets no alternate credentials — may
-/// open it, and never over the network.
+/// open it.
 /// </summary>
+/// <remarks>
+/// There is deliberately no deny entry for <c>NT AUTHORITY\NETWORK</c>. That SID marks a network
+/// <em>logon</em>, not a remote caller: a gateway started from an SSH or WinRM session carries it in
+/// its own token, so a deny entry locked its own same-machine workers out (found on windev, #187).
+/// </remarks>
 internal static class WorkerPipeSecurity
 {
     /// <summary>Gets the options every worker pipe is created with on non-Windows hosts.</summary>
@@ -34,8 +39,8 @@ internal static class WorkerPipeSecurity
     }
 
     /// <summary>
-    /// Creates a pipe ACL that grants full control to <paramref name="user"/> only, denies network
-    /// logons, and does not inherit any other entries.
+    /// Creates a pipe ACL that grants full control to <paramref name="user"/> only and does not
+    /// inherit any other entries.
     /// </summary>
     /// <param name="user">The account the gateway and its workers run as.</param>
     /// <returns>The pipe security descriptor.</returns>
@@ -51,12 +56,6 @@ internal static class WorkerPipeSecurity
         security.SetOwner(user);
         security.AddAccessRule(new PipeAccessRule(user, PipeAccessRights.FullControl, AccessControlType.Allow));
 
-        // A network logon of the same account still carries the user SID; the deny ACE keeps the
-        // pipe local-only regardless.
-        security.AddAccessRule(new PipeAccessRule(
-            new SecurityIdentifier(WellKnownSidType.NetworkSid, domainSid: null),
-            PipeAccessRights.FullControl,
-            AccessControlType.Deny));
 
         return security;
     }