A user with "write" permission can delete a case using API

### Request Type
Bug

### Work Environment
TheHive <= 3.1.2

### Problem Description
Using the UI, an user requires "admin" right to delete a case.Using the API, only "write" permission is enough.
This is inconsistent.

### Possible Solutions
The back-end should refuse to delete a case if the user is not admin.