core: add permission checks to lsp and todo tools