Fix a bug where interceptor validation ignores attributes introduced via Extend on payload/result user types. Interceptors now correctly validate access to attributes merged from Bases.

Changes:
- Update validateAttributeAccess to accept the target *AttributeExpr and use target.Find(name) so inherited attributes (Extend/References/UserType) are recognized.
- Adjust all call sites to pass duplicated payload/result/streaming attributes.

Tests:
- Add cases in expr/interceptor_test.go for payload/result/streaming payload when user types Extend base types providing the accessed attribute.
- All new tests pass; they would fail prior to this change.

Compatibility:
- No public API changes; internal method signature changed only.

Notes:
- Validation runs pre-finalization; switching to Find ensures we traverse Bases and References consistently with other validations.
- Lint and full test suite (including JSON-RPC integration tests) pass locally.