Add "assignment checks" to API endpoints that set labels on entities

[lucasmrod]

Related user story

#33760

Task

Now that we are introducing labels that can belong to teams, we need to add checks on all the API endpoints that allow configuring labels on entities (policies, queries, software installers, VPP apps, FMAs and profiles).
The check is to make sure the team the labels belong to match the team of the entity being configured.