Fix - Enforce Album permissions, allowlist, sanitization on media edit

[Intenzi]

Summary

Addresses authorization and mass database assignment vulnerabilities in media edit requests.

Changes

1. Album Permission Check: Added rtmedia_current_user_can_add_to_album() verification in RTMediaTemplate::save_single_edit() before allowing media to be moved to a destination album.

2. Strict Allowlist Sanitization: Updated rtmedia_sanitize_object() to enforce a strict allowlist using the $exceptions parameter, preventing arbitrary database columns (e.g., media_author, views, likes) from being modified.

3. Privacy Level Validation: Validated privacy key input via rtmedia_sanitize_privacy_level() to ensure only allowed privacy integers are stored.

[rtBot]

Unable to PHPCS or SVG scan one or more files due to error running PHPCS/SVG scanner:

• app/main/controllers/template/RTMediaTemplate.php
• app/main/controllers/template/rtmedia-functions.php
• app/main/controllers/upload/RTMediaUploadEndpoint.php

The error may be temporary. If the error persists, please contact a human (commit-ID: be9386a).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.