open-webui: Missing calendar write permission check in event update endpoint

The POST /api/v1/calendars/events/{event_id}/update endpoint validates write access to the source calendar but does not validate the destination calendar_id in the request body, allowing a user to move an event into any calendar whose ID they know.

All users of open-webui with default configuration (ENABLE_CALENDAR and USER_PERMISSIONS_FEATURES_CALENDAR both True). A user with read-only access to a shared calendar can escalate to write, and any user can inject events into other users' calendars.

Apply the fix by adding a destination calendar write permission check in the update_event endpoint, or disable the calendar feature if not needed.