Fix(Core): use item-scoped access check on escalation routes

[stonebuzz]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

use item-scoped access check on escalation routes

Screenshots (if appropriate):

[Rom1-B]

Can you add a test asserting a user with only ASSIGN (not UPDATE) can reach these routes, and one with only UPDATE (not ASSIGN) cannot?