Preserve caller path filters in asset-scoped rules queries #3479

Description

In an asset-scoped engine, AssetsFacade.getResults(AssetQuery) replaces the caller's paths with the engine's asset path. This discards narrower caller selections and can return more assets than requested, although the engine's asset-subtree boundary remains enforced.

Examples:

• A rule scoped to asset A queries descendant B's subtree. Replacing that filter with A's path can return assets from A's entire subtree.
• A query with an explicitly empty paths array should return no assets, but the facade replaces it with the engine's path and can return assets.
• A caller path outside the engine's subtree is replaced rather than producing an empty intersection.

Related to #2675 (Rules service facade scoping). This follows the same principle as preserving caller attribute filters in the users facade. It is separate from caller-query isolation and from the batch-dispatch bug in #3476.

Expected behavior

Return the intersection of the caller's requested selection and the engine's permitted realm/subtree. Preserve the existing OR semantics between caller-supplied path alternatives; the engine restriction must constrain every alternative.

Implementation Notes

Affected method: manager/src/main/java/org/openremote/manager/rules/facade/AssetsFacade.java, getResults.

Appending the engine path as another OR alternative would broaden the selection and is not sufficient. Copying the query alone also does not fix the overwritten filters.

Implement in a dedicated PR, separate from query isolation.