Function validate_and_prepare_template_session 

pub async fn validate_and_prepare_template_session(
    infra: &InfraContext<'_>,
    token: &str,
    params: &ApplyTemplateParams,
) -> Result<(BosSession, Vec<String>), Error>

Build the [BosSession] that create_bos_session will submit, after validating every xname/group the operation will touch.

Authorization runs in two passes: first against the template’s own targets (group members or explicit xnames), then against each comma-separated entry of params.limit, which may itself be an xname or a group label. An unrecognised limit value yields BadRequest; a missing template yields NotFound. The returned Vec<String> is the split limit list, useful when the caller wants to display the resolved targets before creation.