Gate Teams ACL rules on core capability; fix item-set update warnings and EM usage

[Copilot]

Problem

Teams' ACL rule registration could grant a role capabilities that Omeka core never grants that role at all. Confirmed empirically: a researcher made a team manager with full item permissions could create an item set via the API, even though core's AclFactory grants researcher zero create/update/delete capability anywhere. Teams must act strictly as a gate in front of core — narrowing what core already permits, never granting beyond it. A user needs the ability in Teams and in core.

Additionally fixed two smaller confirmed bugs found while investigating: unguarded array keys in item-set update causing PHP warnings, and a direct entity-manager usage that should go through the API.

Changes

ACL: enforce "Teams AND core" gating (src/Service/AclRuleManager.php)

• Added ROLES_WITHOUT_CORE_CREATE_UPDATE_DELETE (currently ['researcher']) — the set of core roles that core never grants create/update/delete to, for any resource Teams controls.
• Added coreForbidsEntirely(), checked before registering any Teams rule for a role/resource/privilege combination; when true, Teams registers no rule and defers to core's own default deny. Teams-owned entities (TeamResource, TeamAsset) are exempt since core has no rule for them to begin with.

foreach ($this->entities as $resource) {
    foreach ($rolesToControl as $role) {
        foreach (self::ENTITY_PRIVILEGES as $privilege) {
            if ($this->coreForbidsEntirely($role, $resource)) {
                continue; // core forbids this outright; leave its deny in place
            }
            // ... existing allow/deny registration
        }
    }
}

Module.php

• itemSetUpdate(): guards add_team/remove_team request-content keys with ?? [], eliminating undefined-array-key/foreach-on-null warnings when an update omits team changes.
• userUpdate(): the "-1 sentinel" new-team-creation path now uses $api->create('team', ...) instead of instantiating and persisting the entity directly.

Tests (tests/integration/run.php)

• New regression case: a researcher team manager with full item permissions cannot create an item set (core denies outright).
• Counterpart case: an editor team manager with full item permissions can create an item set (both Teams and core permit it).
• Existing editor/site_admin ACL matrix and no-warning-on-teamless-update coverage retained.