fix(plugin-security): require by-id write targets to be within the caller's readable set under select-only RLS

fix(plugin-security): require by-id write targets to be within the caller's readable set under select-only RLS #17819