fix: bind prompt history/version ops to the authorized prompt (#25056)

The history diff, delete, and version-restore routes authorize the URL
prompt_id but then act on a caller-supplied history/version id without
checking it belongs to that prompt (IDOR). Filter by prompt_id in
compute_diff and delete_history_entry, and reject a cross-prompt version_id
in update_prompt_version.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/open_webui/models/prompts.py

@@ -580,7 +580,8 @@ class PromptsTable:
 
                 history_entry = await PromptHistories.get_history_entry_by_id(version_id, db=session)
 
-                if not history_entry:
+                # Reject a version_id from another prompt; restoring it would copy a foreign snapshot in.
+                if not history_entry or history_entry.prompt_id != prompt_id:
                     return None
 
                 # Restore prompt content from the snapshot