case 4712 - customer contacts work only with their own service requests and units

Step 3 of 4712 (security review F14). The Customer role has change rights on
service requests and nothing checked whose they were. For customer contacts:
another customer's request is not found (read, update, delete); creating or
moving a request to a customer the contact does not own is refused (403); a
contact's request is always requested by that contact. unit/customerunit adds
units only to the contact's own customer (or one of its head office's).

Checked: another customer's request 404 (was 200), create for another customer
403, own request created and deleted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

devdocs/modernization/SECURITY-REVIEW.md

@@ -198,7 +198,7 @@ take the next free number; a fixed or accepted finding keeps its ID and changes
 | F18 | Critical | **fixed in case 4716** | Pick-list search text is put into SQL without escaping; any logged-in user can reach it |
 | F26 | Critical | **fixed in case 4717** | KPI `interval` criterion is put into SQL unchecked; reachable by staff users down to TechRestricted |
 | F13 | High | **fixed in case 4712** | Customer contacts can open any customer's work order (customer view, customer report, attachments) by id |
-| F14 | High | **confirmed** | Customer contacts can read, and by code change, delete and create, any customer's service requests |
+| F14 | High | **fixed in case 4712** | Customer contacts can read, and by code change, delete and create, any customer's service requests |
 | F15 | High | **confirmed** | Customer contacts can list every customer (and vendors, users, parts...) with any pick-list columns, phones and emails included |
 | F16 | High | **confirmed** | `schedule/svc` and `schedule/user` have no role check: anyone logged in sees the whole service schedule |
 | F17 | Medium | confirmed (code) | Notification subscriptions accept any `UserId`, and object events reach subscribers without a rights check: record names to any email address |