A three-judge panel ruled on Thursday that the woman’s possession of a user card provided her legal protection for medically directed cannabis treatments.