Fix permission callback for email-reporting EDITABLE route

## Bug Description

- https://github.com/google/site-kit-wp/blob/develop/includes/Core/Email_Reporting/REST_Email_Reporting_Controller.php#L190-L199

The `core/site/data/email-reporting` EDITABLE (POST/PUT/PATCH) route uses the `$can_access` permission callback, which allows any user with `VIEW_DASHBOARD` capability to modify the global email reporting `enabled` setting. All other write routes in the same controller (`REST_Email_Reporting_Controller`) use the `$can_manage` callback, which requires `MANAGE_OPTIONS` (administrator).

This means shared dashboard users (Subscribers, Contributors) can toggle email reporting on/off site-wide.

## Steps to reproduce

1. As an admin, enable Dashboard Sharing in Site Kit and add the "Subscriber" role to a module's shared roles.
2. Log in as a Subscriber who has dismissed the shared dashboard splash screen.
3. Navigate to the Site Kit dashboard.
4. Open the browser console and run:
```javascript
wp.apiFetch({
path: '/google-site-kit/v1/core/site/data/email-reporting',
method: 'POST',
data: { data: { settings: { enabled: false } } }
}).then(console.log).catch(console.error);
```

5. Observe a 200 OK response. Log in as an administrator to verify the email reporting setting has been changed.

Screenshots

N/A — API-level issue, no UI involved.

Additional Context

- PHP Version: Any
- OS: Any
- Browser: Any
- Plugin Version: 1.162.0+ (when email reporting was introduced)
- Device: Any

The issue is in includes/Core/Email_Reporting/REST_Email_Reporting_Controller.php line 199. The $can_manage closure is already defined in the same method but is not used for this route.

For reference, all other routes in this controller use $can_manage for write operations:
- email-reporting-invite-user (EDITABLE) → $can_manage
- email-reporting-eligible-subscribers (READABLE) → $can_manage
- email-reporting-errors (READABLE) → $can_manage

---
Acceptance criteria

- The core/site/data/email-reporting EDITABLE route must require MANAGE_OPTIONS permission.
- Shared dashboard users without admin privileges must receive a 403 Forbidden response when attempting to POST to this endpoint.

Implementation Brief

- In includes/Core/Email_Reporting/REST_Email_Reporting_Controller.php, change line 199 from 'permission_callback' => $can_access, to 'permission_callback' => $can_manage,.

Test Coverage

- Add a test in REST_Email_Reporting_ControllerTest.php verifying that a shared dashboard user (Subscriber with VIEW_DASHBOARD) receives a 403 when POSTing to core/site/data/email-reporting.

QA Brief

- As a shared dashboard Subscriber, attempt to POST to the email-reporting endpoint and verify a 403 response is returned and the setting is unchanged.

Changelog entry

- Fixed the email-reporting EDITABLE route to require MANAGE_OPTIONS permission, preventing shared dashboard users from modifying global email reporting settings.

Start in includes/Core/Email_Reporting/REST_Email_Reporting_Controller.php around line 199 and compare the permission callbacks used by the other routes. Add the requested coverage in REST_Email_Reporting_ControllerTest.php, then verify that a shared Subscriber receives 403 when POSTing to core/site/data/email-reporting; done means the route requires MANAGE_OPTIONS.

Written by the indexing model from the issue text.