[report] Harden data access for reports (#13111)

* [report] Harden data access for reports

- Exclude sensitive data
- Prevent database writes during report generation

* Fix typo

* Add regression test against model traversal

* Add webhook endpoint and message to imports

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Remove some models from BLOCKED_MODELS

* Revert READ_ONLY requirement

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

docs/docs/report/helpers.md

@@ -216,6 +216,9 @@ The `filter_db_model` function allows for filtering of a database model based on
         show_docstring_description: false
         show_source: False
 
+!!! warning "Restricted Data"
+    While a template renders, tables holding sensitive information - such as user sessions, API tokens, outbound emails, plugin settings and social / OAuth / MFA data - are blocked. Access raises a permission error. This is defence-in-depth only: it works on whole tables, and templates remain [trusted](../concepts/threat_model.md).
+
 #### Example
 
 Generate a list of all active customers: