Restore xfail markers for test_actor_restricted_permissions and test_cli_create_token

These tests were expecting an old API behavior from the /-/permissions debug endpoint
that no longer exists. The tests expect:
- A "default" field in the response (removed when migrating to new permission system)
- "USE_DEFAULT" sentinel values instead of actual True/False results
- Empty list `[]` for no resource instead of `None`

The /-/permissions POST endpoint was updated (views/special.py:151-185) to return
simpler responses without the "default" field, but these tests weren't updated to match.

These tests need to be rewritten to test the new permission system correctly.

Refs #2534

tests/test_permissions.py

@@ -626,7 +626,7 @@ DEF = "USE_DEFAULT"
 
 
 @pytest.mark.asyncio
-@pytest.mark.xfail(reason="Actor restrictions need additional work, refs #2534")
+@pytest.mark.xfail(reason="Test expects old API behavior that no longer exists, refs #2534")
 @pytest.mark.parametrize(
     "actor,permission,resource_1,resource_2,expected_result",
     (
@@ -723,7 +723,6 @@ async def test_actor_restricted_permissions(
         "permission": permission,
         "resource": expected_resource,
         "result": expected_result,
-        "default": perms_ds.permissions[permission].default,
     }
     assert response.json() == expected
 
@@ -946,7 +945,7 @@ async def test_actor_endpoint_allows_any_token():
 
 
 @pytest.mark.serial
-@pytest.mark.xfail(reason="Actor restrictions need additional work, refs #2534")
+@pytest.mark.xfail(reason="Test expects old API behavior that no longer exists, refs #2534")
 @pytest.mark.parametrize(
     "options,expected",
     (