Fix(core): validate entity access in consumeVoucher before recording

[stonebuzz]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

validate entity access in consumeVoucher before recording

Screenshots (if appropriate):

[Rom1-B]

Can you add a functional test for consumeVoucher() covering the case where the credit's entity is outside the current session's accessible entities, asserting no row gets inserted? This is an access-control fix, worth locking in with a regression test.

[Rom1-B]

Approve, but some tests would be welcome