Inconsistent event stream permission handling between core and enterprise slicing

### Description

When a user without explicit `streams:read` permission for the default events stream (`000000000000000000000002`) uses the "Slice by" feature on the `/alerts` page, the behavior differs depending on whether an enterprise security license is active:

- **With enterprise license**: Slicing works correctly
- **Without enterprise license**: Returns a `MissingStreamPermission` error for the default events stream

### Root cause

[`allowedEventStreams()` in `AbstractEventsSearchService.java:136`](https://github.com/Graylog2/graylog2-server/blob/d03e2f7b31c48e76749b08eec2a61d3c1b5b18ea/graylog2-server/src/main/java/org/graylog/events/search/AbstractEventsSearchService.java#L136) unconditionally includes the default events stream, assuming every user should be able to search it. The enterprise slicing path accepts this and proceeds. The core slicing path (`EventsSliceService`) passes these streams through the Scripting API, which re-validates stream permissions using `SearchUser` — and rejects the stream if the user lacks explicit permission.

### Steps to reproduce

1. Create a user with the `Reader` role and no explicit `streams:read` permission for the default events stream
2. Remove the security license
3. Navigate to `/alerts`
4. Click a column header and select "Slice by values"
5. Observe the `MissingStreamPermission` error

### Expected behavior

Both paths should handle event stream permissions consistently — either both should allow the default events stream for all users, or both should enforce explicit permission checks.