[security] check attributes: dispatch on the "add" action if entity was just created
cw_set on a just-created entity (i.e. created in the same transaction)
should behave the same as setting the attribute directly on creation:
check the 'add' permissions, not 'update'.
Closes #4740310.