CVE-2026-54076: ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

The fix for CVE-2026-44221 (GHSA-fxc7-fm93-6q77) added an UPDATE_SCHEMA authorization check to a single schema-mutating method (LocalDocumentType.createProperty). The remaining public schema mutators were left unchecked, so an authenticated identity (including a read-only API token) that lacks the UPDATE_SCHEMA permission could still mutate the database schema on its own database:

• DROP PROPERTY <type>.<property>
• ALTER TYPE <name> SUPERTYPE +<other> / -<other> (change the inheritance hierarchy)
• ALTER TYPE <name> NAME <newName> (rename a type)
• type alias and bucket changes
• ALTER PROPERTY <type>.<property> ... (MANDATORY, READONLY, NOTNULL, MIN, MAX, REGEXP, DEFAULT, OF, CUSTOM) — the LocalProperty setters had no check at all

This does not directly disclose or write record data, but it corrupts the meaning of every stored record and breaches the documented permission model, which advertises UPDATE_SCHEMA as the gating right for schema mutation.