16770 work package api patch for subject

[``* `#16770` Work package API PATCH for subject``](https://community.openproject.org/work_packages/16770)

This PR applies the specified behavior outlined in #2056.
This here looks like validations. How about moving them into the api model, the form? We would have to remove the read only constraints from the decorator but could prevent the attributes from being written by adding the appropriate errors in the model. The error code is the same for both cases (422). IMO this would also be beneficial for the lock_version conflict case (409). This would:
* remove the necessity to duplicate the read only property check (in the decorator and in the VALID_UPDATE_ATTRIBUTES)
* cleanup the controller
 * ```check_work_package_attributes```
 * ```check_lock_version```
 * ...
* make the form/contract reusable in more places than just the API

After the errors are added in the form, we could then create go through these and generate API::Errors::... instances based on the error we encounter (409, 422, ...). Not sure about the correct object to do so but that would enable us to reuse the object for other API resources as well because the error handling should always be the same.

We might even place the authorization checks in the model. This again would enable reusability and leave the method body with something like this:
<pre>
patch do
  @representer.from_json(env['api.request.input'])

  if @representer.represented.valid? and
     @representer.represented.sync and
     @representer.represented.save

    @representer
  else
     fail ::API::Errors::?SomeFactory?(@representer.represented)
  end
end
</pre>