Require products.write for product writes

[kaareal]

Split from #302.

The products routes only called authenticate(), so any user could create, change or delete any product. POST, PATCH and DELETE now require products.write. OpenAPI updated with the x-permissions.

[github-actions]

API Changes

Operations

• Changed POST /1/products
  • Added x-permissions
• Changed PATCH /1/products/:id
  • Added x-permissions
• Changed DELETE /1/products/:id
  • Added x-permissions