prevent adding/removing guardians without global change_subject permission

Closed Bengfort requested to merge fix-add-guardian-perm-2 into main

replaces !2044 (closed)

This prevents leaking the subject ID to users who would otherwise not have access to it.

Merge request reports