[security] Test case and fix for an INSERT security hole
7099bbd685aa introduced a untested corner case in which an Entity with no
attribute specified could be created whatever the permissions.
Report and test case by Christophe de Vienne, fix by Aurelien Campeas. Thanks!
Closes #4854359