Feature: make fields allowed to update configureable per doc type

[lebalz]

current behavior

A user can update the data field od a document with any data as long as he has RW access. No other fields are updateable.

issue

Some documents, as for example file or dir should be allowed to update their parent_id

solution

A new model allowed_action is introduxed, which has two columns:

• document_type describes the type of a document
• action describes the allowed action which can be performed for a document

Like that we have a generic solution to configure the api in a dynamic way.

The migration adds two default records:

document_type	action
dir	update@parent_id
file	update@parent_id

The advantage of this solution in comparison to a "static check" in the background is, that conceptual, it is a "client application concerne", so when the frontend implements a new document type that needs to update the "parent_id" aswell, the backend does not need to be updated at all...

Anyway, the api is responsible to correctly parse and interpret the action field - in this case, a doc. can be relinked to another parent doc. when the action is specified as update@parent_id for a given document type.

[lebalz]

@SilasBerger fyi