[BUG] Reports and participants not detected by SecurityServices

[gstuer]

Circumstances
Users cannot add reports to other users or non-owned offers due to SecurityService restrictions.

How to Reproduce
Trying to use the put endpoint for adding reports lead to HTTP response signalizing missing permission.

Expected behavior
Every authenticated user has to have the permission to create and add new reports to other users and non-owned offers.

Additional context
The easiest possible solution would be to add a fix to the SecurityService of user and offer.
A more precise and beautiful alternative would be an own controller, dbrefs and an own repository for reports. Refer to symbolic character of image and password.