Fix/api v2 planning element type authorization

https://www.openproject.org/work_packages/16645

Took the chance to also clean up the controller. It used to raise ActiveRecord::RecordNotFound which doesn't make sense for a controller to make public to the user. It now renders 404 when the project or the type isn't found.