[christianbeeznest]

REST v2 course write actions trusted the client-selected course context and allowed forum/notebook writes without validating that the authenticated user belonged to the selected course or session.

This change adds a common authorization guard to:

• save_forum_thread
• save_forum_post
• save_course_notebook

Platform administrators keep their existing access.

For normal course access, the authenticated user must be subscribed to the selected course.

For session context, the selected session must belong to the course and the user must have an allowed course/session role. Read-only and invisible sessions are rejected for non-teachers.

Verified against a running 1.11.x instance:

• An authenticated user not enrolled in the private course was rejected by all three write actions.
• No unauthorized forum thread, forum post or notebook row was persisted.
• After enrolling the same user as a student, all three legitimate write actions succeeded.
• All temporary forum, thread, post, notebook and membership test data was removed after verification.
• php -l passed.
• git diff --check passed.

The legacy REST endpoint serializes authorization failures as HTTP 200 with error=true; this change fixes the authorization and unauthorized persistence issue without changing that existing transport behavior.

Session-specific role branches were reviewed but were not exercised in the runtime test.

Refs GHSA-hgqr-52jh-f6j7