fix(security): ReportsController — drop _rbac/_multitenancy bypass

`loadDashboard()` was calling the mapper with `_rbac: false,
_multitenancy: false`, then `render()` and `preview()` carry
`@NoAdminRequired`. Combined effect: any authenticated user on any
tenant could render any dashboard by enumerating identifiers, and the
rendered output embeds resolved widget data → cross-tenant exfiltration.

Drop the bypass flags so the standard RBAC + multitenancy filter applies
on every load. Existing schema-level RBAC + tenant scoping is now the
single source of truth for "can this caller see this dashboard?".

Refs: #1419 review (blocker 1) — discussion_r3187494400

Author: rubenvdlinde

lib/Controller/ReportsController.php

@@ -174,11 +174,13 @@ private function loadDashboard(string $identifier): ObjectEntity
     {
         $identifier = trim($identifier);
         $arg        = ctype_digit($identifier) === true ? (int) $identifier : $identifier;
-        return $this->objectMapper->find(
-            $arg,
-            _rbac: false,
-            _multitenancy: false
-        );
+
+        // SECURITY: standard RBAC + multitenancy filtering must apply on every
+        // dashboard load — render/preview surface user-controlled HTML/XLSX/PDF
+        // bytes that embed widget data resolved at render time. Bypassing the
+        // mapper's filters lets any authenticated caller render any dashboard
+        // in any tenant by guessing identifiers (cross-tenant exfiltration).
+        return $this->objectMapper->find($arg);
 
     }//end loadDashboard()
 }//end class