[security] Test case and fix for an INSERT security hole
7099bbd685aa introduced a untested corner case in which an Entity with no
attribute specified could be created whatever the permissions.
Report and test case by Christophe de Vienne, fix by Aurelien Campeas. Thanks!
Closes #4854359
[pkg] don't include extra files in tarballs
Blind wildcards for dirs that may contain generated or temporary files
can lead to trouble and unreproducible results.