Permissions do not seem to be inherited from collections

## Expected Behavior

A system user with the appropriate role and collaborator permissions should be able to access and modify assets contained in a shared collection when both the collection and its contents are shared with that user.

## Current Behavior

A collection was created for SIGMA rules, and all SIGMA rules were added to it. A system user was then created with an API token and assigned the required SIGMA Manager role.

The collection and its contents were shared with the system user as a **Manager Collaborator**. However, when the user attempts to update a SIGMA rule from that collection via the API, Graylog returns an authorization error.

If the same SIGMA rule is shared directly with the same system user as a **Manager Collaborator**, the authorization error no longer occurs.

This suggests that permissions granted through collection sharing are not being applied consistently to the assets inside the collection, or are not being honored by the event definition update endpoint.

## Steps to Reproduce

1. Add one or more SIGMA rules to a collection.
2. Create a system user with an API token.
3. Share the collection and its contents with that system user as a **Manager Collaborator**.
4. Assign the **SIGMA Manager** role to the system user.
5. Using the system user’s API token, call:

```http
PUT /api/events/definitions/{event_definition_id}
```

for one of the SIGMA rules in the shared collection.

## Actual Result

The API request fails with an authorization error.

## Expected Result

The system user should be able to update the SIGMA rule because the collection and its contents are shared with the user as a **Manager Collaborator**, and the user has the required SIGMA Manager role.

## Workaround

Manually sharing each SIGMA rule directly with the system user as a **Manager Collaborator** allows the API request to succeed.

## Environment

Graylog 7.1.3+c34604d on jbxgraylog (Eclipse Adoptium 21.0.11 on Linux 5.15.0-174-generic)

## Excerpts

This causes an Authorization Error:

This works perfectly:

Start by reproducing the failure with a system user's API token against PUT /api/events/definitions/{event_definition_id}, comparing collection-based sharing with direct sharing. Trace the authorization checks for SIGMA rule updates and collection permissions; done means a Manager Collaborator with the SIGMA Manager role can update a rule shared through its collection, with coverage for the reported case.

Written by the indexing model from the issue text.