Channel-scope guard added to StockLocation and Asset update

Channel-scope guard on StockLocation and Asset update().

Also closed remaining cases where a channel-restricted administrator could modify or delete entities in another channel on FacetValue, ProductOption and Promotion delete paths.

An administrator can now only update another administrator if they hold all of the target's permissions on all channels, and updating a SuperAdmin requires a SuperAdmin caller.