A panel writes only what its dashboards' inputs target

It still reads every message its dashboards show. A message a tile only
draws, or a setting is bound to, is no longer writable from the panel.

backend/tests/api/routes/test_panels.py

@@ -373,7 +373,8 @@ def test_a_panel_speaks_only_its_own_widgets_messages(
             == 404
         ), target
 
-    # And reads the history of everything its widgets bind to.
+    # And reads the history of everything its widgets bind to, but writes none
+    # of what they only draw.
     for name in (
         "demo.temperature",
         "demo.switch_state",
@@ -384,6 +385,12 @@ def test_a_panel_speaks_only_its_own_widgets_messages(
             client.get(f"{messages}/{name}/history", headers=panel_headers).status_code
             == 200
         ), name
+        assert (
+            client.post(
+                f"{messages}/{name}", headers=panel_headers, json={"value": 1}
+            ).status_code
+            == 403
+        ), name
 
     # A message no tile on this panel names is not its business, in either
     # direction.