Fix(core):Fix model selector validation and access control

[stonebuzz]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• Model identifiers received by the preview and report popups are now validated as integers before being used.
• Model names and entity names are now escaped in the injection model selector.
• The mapping form now verifies that each submitted mapping belongs to the model being edited, and checks the update right on that model.
• Rights on relation itemtypes are now evaluated like any other itemtype when deciding whether a model can be listed and used.

Screenshots (if appropriate):