feat(submission): add project_contributors dependency for permission …

[Anuj-Gupta4]

What type of PR is this?

• 🍕 Feature

Related Issue

Fixes Make submission data downloads only possible for project contributors #1849

Describe this PR

The code adds a dependency to the routes responsible for submission downloads to only allow access if they are a project contributor.

Review Guide

The criteria to be a project contributor may need further discussion.

Checklist before requesting a review

• 📖 Read the FMTM Contributing Guide: https://github.com/hotosm/fmtm/blob/main/CONTRIBUTING.md
• 📖 Read the HOT Code of Conduct: https://docs.hotosm.org/code-of-conduct
• 👷‍♀️ Create small PRs. In most cases, this will be possible.
• ✅ Provide tests for your changes.
• 📝 Use descriptive commit messages.
• 📗 Update any related documentation and include any relevant screenshots.

[spwoodcock]

Minor change to a comment needed, but this is a really neat addition 😄

My only concern is that this is quite restrictive.

In the long term I think we need to go the route discussed a few meetings ago, with different level of project access being properly implemented. So this logic would perhaps be moved to the mapper role, determining access based on the 4 project visibilities discussed.

Let's go with that for now though!