Fix EZP-22457: XMLText uses canUser API wrong on location embeds

This PR resolves issue https://jira.ez.no/browse/EZP-22457

Usage of `Repository::canUser()` was incorrect when checking permissions on Content in a Location, providing Location as object and not providing target. All nice with unit tests :)

This fixes the problem.