Handler access checks in SOAP API

The mc_issue_add() and mc_issue_update() APIs were missing checks to validate that specified handler has the appropriate access level and that logged in user have access level to assign issues.

I suggest that we port this fix to master-1.2.x to make it in 1.2.18.

Fixes #16993
Maybe it's worth extracting the validation code in a separate function.

+1 otherwise