As a Forum-Admin or -moderator (or user), i have more fine-granular security with custom permissions (e.g. "Modearate&Post") for the forum workspace

Make sure, that the Forum-modules registers it specific permission to the config. of the security-app.
This will allow to specify the specific forum-roles like it was possible with Magnolia 4.5 (see attachment).

Because these are special permissions, they cannot be mapped to standard JCR-permissions, that's why "every" code-execution must be checked security-wise using the "old" security-interface (e.g. things like PermissionUtil.isGranted(((Content) message).getJCRNode(), ForumConfiguration.MODERATE_PERMISSION)).
Make sure that new actions and or commands take this into account.