Fix permissions checks for `eligible_objects`

Ensure that dashboard forms employ the same permission checks as admin
forms. In particular, nodes and devices not managed/owned by the current
user should not be accepted as attribute values.