CVE-2026-49439: OpenRemote read-only asset users can write predicted datapoints

The predicted datapoint write endpoint allows users with only read:assets privileges to write predicted datapoints.

The endpoint:

PUT /api/{realm}/asset/predicted/{assetId}/{attributeName}

accepts write requests from users lacking write:assets.

The implementation appears to check READ_ASSETS while performing a write operation through:

assetPredictedDatapointService.updateValues(...)