Fix ticket observer can edit

[Herafia]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• It fixes !46589
• An observer on a ticket could modify and save custom fields
  because rights were only checked at the container-profile level, not against the
  specific item. Fields are now rendered as read-only for users who cannot update the
  item, and the pre_item_update hook enforces the same check server-side.

[Rom1-B]

Can you add a test covering PluginFieldsContainer::preItemUpdate() directly (e.g. a central-interface user without ticket update right but with write access on the container) asserting _plugin_fields_data is stripped/not persisted?

[Rom1-B]

Scoping this to helpdesk + CommonITILObject reopens the bug for central-interface users without update right (e.g. an observer with only READASSIGN). The patch validated on ticket !46589 used !$item->canUpdateItem() unconditionally, matching the field.class.php display-side fix — Ticket::canUpdateItem() already handles both interfaces correctly.

Suggested change

	if (
	isset($_SESSION['glpiactiveprofile']['id'])
	&& $_SESSION['glpiactiveprofile']['id'] != null
	&& $item instanceof CommonITILObject
	&& Session::getCurrentInterface() === 'helpdesk'
	&& !$item->canRequesterUpdateItem()
	) {
	if (
	isset($_SESSION['glpiactiveprofile']['id'])
	&& $_SESSION['glpiactiveprofile']['id'] !== null
	&& !$item->canUpdateItem()
	) {

[stonebuzz]

This is a rights fix and the PR adds no test, even though tests/Units/ContainerItemRightTest.php already covers this area. A non-regression test should log in as a self-service observer, call $ticket->update([... dom field values ...]) and assert the stored value did not change. A second test should assert that a requester who is still allowed to edit (no followup yet) can save.

[stonebuzz]

The new $canedit rule ($item->isNewItem() || $item->canUpdateItem()) is untested, both here and in showForTabContainer() at line 894. A rendering test should assert that the inputs are read-only for a helpdesk observer and editable on a new item.