Fix: mass assignment update project #3875

[Nixxx19]

Fixes #3875

Changes

• Whitelist allowed fields in updateProject (name, files, updatedAt, visibility) so user, slug, etc. can't be overwritten via the request body.
• Mark user and slug as immutable: true in the Project schema so ownership and URL can't be changed via updates.
• Add tests for updateProject: 404, 403, whitelist (user/slug in body ignored), and that allowed fields are applied.

updateProject tests (all passing):

I have verified that this pull request:

• has no linting errors (npm run lint)
• has no test errors (npm run test)
• has no typecheck errors (npm run typecheck)
• is from a uniquely-named feature branch and is up to date with the develop branch.
• is descriptively named and links to an issue number, i.e. Fixes #3875
• meets the standards outlined in the accessibility guidelines

[Iron-56]

@raclim could you merge the PR? I have verified both the working and the test file.