GHSA-rqj7-6wrp-6g2g: Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission

Open WebUI had a security gap where the `/api/v1/images/edit` endpoint (a path for sending image editing requests) didn't check if image editing was allowed, even though other image editing features did. This meant any logged-in user could bypass administrator controls that disabled image editing globally or for specific users, and could make billable requests to image editing services using the admin's credentials. The vulnerability affected versions 0.8.11 through 0.9.x.