PUT /api/v1/devices/:deviceId accepts a target snapshot from another application in the team #8815

The route only checks that the snapshot belongs to the device's team. Device groups check that the snapshot belongs to the same application, because granular RBAC can give a user access to one application and not another in the same team.

Steps to reproduce

1. A user has device:edit on application A and no access to application B in the same team.
2. They set a snapshot of an instance in application B as the target of a device in application A.

The route accepts it, and the device deploys the other application's flows.

Expected

The route rejects a snapshot from a different application, the same way updateDeviceGroup does.

Reference

forge/routes/api/device.js:743-747, forge/ee/db/controllers/DeviceGroup.js:107-122.