Media permissions let an engine write assets #2666

Part of #2427 (F-MED). Found by the review of #2555.

AgentPermissions.CheckMediaAsync lets a system initiator through, while CheckContentAsync refuses one (ADR-0012). An engine, such as an extension check type running in the caller's scope, could therefore delete or restore a media asset through IMediaLibrary, while the same call for an entry is refused. No current code does this.

Scope

• CheckMediaAsync refuses a system initiator for write operations (create, update, delete), as CheckContentAsync does, with the same error.
• Reads stay allowed.

Out of scope

• Changes to what agents and people may do with media.

Acceptance

• An engine is refused upload, update, delete and restore of an asset, with the code the content checks use.
• Agents and people keep their current permissions.
• Unit tests in the permission tests.