Disable move function on shared folder, if target is out of scope of shared root folder

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.

Example usecase:

• You have a shared folder [Team 1] for 5 people,
  and everybody should be able to edit/rename/update/delete on all files in this share.
  The share further is not syncable (protected by hidden-Tag and "file access control")

• Then u have a further shared folder [Team 2] for 3 people,
  and also everybody should be able to edit/rename/update/delete on all files in this share.
  The share further is not syncable (protected by hidden-Tag and "file access control")

• Further all 8 people also have their own folders in user space (unlimted)

Then u got a problem with the "moveFileFunction", as everbybody is able to move files from shared folder to his own root folder (in user space) or to a subfolder (in user space). Then further from his user space, he can do everything, also sync!, what is in upper usecase not allowed.

Actually i found no way to protect it, also tried things like "File access control" and "Group folders".

Describe the solution you'd like

• A user and shared permission based solution, which allow either move operation out of shared-root scope or forbid it.

Describe alternatives you've considered

• For the moment i build a simple, alpha like, solution which just take care that the targetPath of the moveFileFunction call, is valid to the RootPath of the share. (it works with just one file to be edited)

Additional context
Here some examples:

• Example of allowed moving files:
  i am at → /EXT_Storage_Local/ and try to move the New text file.md to → /EXT_Storage_Local/sub1/sub2/sub3
  

• Example of forbidden moving files:
  i am at → /EXT_Storage_Local/ and try to move the New text file.md to → /GroupFolder_Elektro
  as you can see on image, move operation fails and gives user a message as this move lays not in the allowed RootPath.
  

• Further i found the same problem on different topics also in the NC Community Forum
  https://help.nextcloud.com/t/shared-disable-move-copy-option/45997
  https://help.nextcloud.com/t/prevent-copying-moving-of-files/50307
  https://help.nextcloud.com/t/how-to-prevent-accidentally-moving-folders/83808

• Setup:
  Debian 12 with NC 27.1.2

The issue names no files, tests, or entry points. Start by tracing the server-side move operation and the permission checks for shared-folder roots, then identify how a target outside the share is handled; done means the requested move restriction is implemented with coverage for allowed moves within the share and rejected moves outside it.