MSA-26-0029: Missing capability checks in report builder fragment callbacks

Description:       The report builder fragment output callbacks did not verify
that the requesting user had the required capability to
access the requested report, potentially allowing users to
retrieve report data beyond their permitted access.
Issue summary:     Missing capability checks in report builder fragment
callbacks
Severity/Risk:     Minor
Versions affected: 5.2, 5.1 to 5.1.4, 5.0 to 5.0.7, 4.5 to 4.5.11 and earlier
unsupported versions
Versions fixed:    5.2.1, 5.1.5, 5.0.8 and 4.5.12
Reported by:       Paul Holden
Issue no.:         MDL-84535