Harmonize watchers endpoints

## OpenProject Work Packages

* https://community.openproject.org/work_packages/17755
* includes non WP specifications that harmonize the API

## Content

* new endpoint for current watchers of a work package
* clarification on when to return 404 and 403 for some endpoints
    * this change *should* not affect the actual implementation, however I did not verify that
* allow adding multiple watchers at once
* endpoint for available watchers is now also placed under a project scope

## Changes to existing endpoints

* watchers are linked in Work Package
* the `watch` link of the work package has an updated `data` section
* embedding format of watchers changes (real collection)
* add watchers now accepts a new request format
* add watchers now returns the list of current watchers
* the available watchers endpoint was moved into a per project scope
No it shouldn't. This is the trick with all this 403/404 clarification we can return proper status codes when the user is allowed to know about them.

OMG, my ASCII-Art skills:
````
           | can edit | can't edit |
-----------|----------|------------|
can view   |  200     |   403      |
can't view |  404     |   404      |
````

In other words: If you are not allowed to see the WP, you will **always** receive a 404. If you are allowed to see the WP, you will receive a 403 if you are solely missing the edit rights.

Obviously 404 is also possible for WPs that are *really* non existent.