(fix): address review findings — 1 HIGH, 0 MEDIUM

Restore strict-equivalence regex in MongoPermissionFilter to match the
hardening applied in main by 6d50ac1 ("Force strict equivalence in mongo
role checks"). The query-lib refactor extracted the three Mongo.php call
sites into this hook but reverted the pattern to the pre-fix form that
matches stored permissions whose role substring contains any of the
caller's roles, enabling a read-side authorization bypass.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: 2 people

src/Database/Hook/MongoPermissionFilter.php

@@ -48,7 +48,7 @@ public function applyFilters(array $filters, string $collection, string $forPerm
         $permissionsFilter = isset($filters['_permissions']) && \is_array($filters['_permissions'])
             ? $filters['_permissions']
             : [];
-        $permissionsFilter['$in'] = [new Regex("{$forPermission}\\(\".*(?:{$roles}).*\"\\)", 'i')];
+        $permissionsFilter['$in'] = [new Regex("{$forPermission}\\(\"(?:{$roles})\"\\)", 'i')];
         $filters['_permissions'] = $permissionsFilter;
 
         return $filters;