[cocoon02]

Allow custodians to update and delete these records, with cancer type filter changes gated by dedicated permissions.

Screenshots (if relevant)

Describe your changes

Project grants and cancer type filters can now be updated and deleted through the API, not only listed and created.

Project grants

PUT /api/v1/project_grants/{id} replaces the grant and stores a new version.
PATCH /api/v1/project_grants/{id} updates only the fields sent, on the latest version.
DELETE /api/v1/project_grants/{id} soft-deletes the grant and its versions.
Create, update, edit, and delete now go through ProjectGrantService.
Write routes use the existing project_grants.create, project_grants.update, and project_grants.delete permissions, and the controller still checks that the caller belongs to the grant's team.

Cancer type filters

POST, PUT, PATCH, and DELETE were added on /api/v1/cancer-type-filters.
level is derived from the parent. Moving a filter recalculates levels for its descendants, and a filter cannot be moved under itself or one of its descendants.
Deleting a filter also deletes its descendants.
New permissions cancer_type_filters.read, create, update, and delete are seeded and granted to custodian.team.admin, custodian.metadata.manager, and custodian.dar.manager. hdruk.superadmin already receives every permission. A migration adds the same permissions on existing databases.
GET list and show stay public.

Issue ticket link

Environment / Configuration changes (if applicable)

Requires migrations being run?

If not using the pre-push hook. Confirm tests pass:

Checklist before requesting a review

• I have performed a self-review of my code
• I have added appropriate unit tests
• I have created mocks for unit tests (where appropriate)
• I have added appropriate Behat tests to confirm AC (if applicable)
• I have added Swagger annotations for new endpoints (if applicable)
• I have added audit logs for new operation logic (if applicable)
• I have added new environment variables to the .env.example file (if applicable)
• I have added new environment variables to terraform repository (if applicable)

[gh-actions-pipelines-app]

🎉 Great job! Your PR title follows the correct format. 🚀