Worklist ACL tests: local Modify no longer required for worklist read/write

Updates this project's worklist ACL test coverage to match a server/plugin fix that removes worklist creation/update's dependency on local Modify permission.

Background

Worklist operations (POST/PUT to /studies/{id}/worklists/{wid}) previously required both the server/group-level worklist permission and local Modify on the study — not because worklist review genuinely needs it, but because of how the Orthanc Advanced Authorization plugin explodes a nested resource request into its full patient → study ancestor hierarchy. The patient-ancestor call carried no information distinguishing "this is a worklist request" from "this is a real modify request," so it fell through to the generic modify-traversal check, and a hand-written workaround in orthanc-sonador (_fetch_patient_policy's "worklist exemption") papered over the gap by granting the patient a Modify permission the user never actually had.

Modify grants the unrelated, and far more powerful, ability to edit DICOM resource data directly — reusing it purely to satisfy an ancestor-traversal quirk meant any workflow needing worklist access (create/review/complete) also had to be granted that broader capability, more privilege than the feature needs.

The fix (companion changes, not in this MR)

• orthanc-authorization (C++ plugin): DefaultAuthorizationParser::ClassifyAction() now recognizes the worklists path segment and tags the request action="worklist", mirroring the existing "comments" → "comment" handling — so the patient-ancestor call now carries a distinguishing token instead of arriving with none. Already on master (commit 7ac8fb1).
• Sonador web application (lib/orthancapi): oak-tree/medical-imaging/sonador!90 — ResourceAuthorization.resource_perm() gets a new branch resolving action="worklist" ancestor calls via ordinary view instead of the generic modify check.
• orthanc-sonador: oak-tree/medical-imaging/orthanc-sonador!55 — the now-obsolete "worklist exemption" workaround removed from _fetch_patient_policy.

This MR

Two commits, updating the two places in this project's suite that baked in the old (now-incorrect) assumption:

• tests_ext_worklist_procedures.py — test_history_acl_parity previously asserted that a user with local View but no Modify gets a 403 on worklist state transitions and procedure writes. It now asserts those writes succeed, alongside the existing read-access assertions.
• tests_sonadoracl_worklist_security.py — the worklist-reassignment security test granted local Modify alongside View for both users, commented "(View + Modify required for worklist)". That assumption was stale; both grants are now View-only, with the docstring updated to explain why. The test's actual security assertions (revoked access → 403, reassigned access → granted) are unaffected — this only narrows the permission set the test exercises to match reality.

Related work

• Server fix: oak-tree/medical-imaging/orthanc-sonador!55
• Sonador web application fix: oak-tree/medical-imaging/sonador!90 (lib/orthancapi)
• Analogous functional-test update: oak-tree/medical-imaging/sonador-client!73
• Originating feature work: oak-tree/medical-imaging/orthanc-sonador#54