Cross-team modification via incorrect voter invocation

Missing authorization in Kimai before 2.54.0 allows remote authenticated users with edit_team permission to modify unauthorized teams. Eight association endpoints in TeamController pass edit_team as the voter attribute without the team object, so TeamVoter abstains and only the role-level permission is checked. The default configuration limits edit_team to administrators with global data access; exploitation requires assigning it to a lower-privilege role and permits changes to team membership and customer, project, or activity assignments.