Hardens the modal controller so that only users with proper access can see the mermaid diagrams through the modal endpoint. This now respects both entity access and the field level access.
Fixes race condition when updating issue count after dismissal (can result in sending the pre-dismissal count or 0; this fixes itself on next page load).
Clarifies permission labels and adds additional API validation.