Identify and protect images and data sent by producers

[stephanegigandet]

This is to be done in combination with #2085

We currently have a rather crude approach that blocks edits from the API (apps, robotoff etc.) when product data has been imported. The new approach will specifically mark which fields have been sent by the producer.

1. use the product edit history to create a new producer_provided_fields array with the list of fields added/changed by the manufacturer.

• when the fields were changed by import_csv_file.pl
• or when the fields were changed by a user that is marked as a producer who sends us complete data

2. allow only specific expert users to change those fields

Tag fields like labels etc. can still be added to, and images can still be added (not not selected if an existing image is present).

Part of

• 🏭 Producers platform (Tracker issue) #5521

[teolemon]

lgtm

[stephanegigandet]

Also see #8282

We already have a mechanism in place to protect data sent by producers. See #8274

I think we are missing the protection for images selected by producers and coming from the pro platform.

Suggested approach:

1. Test on a dev environment if images sent and selected from the pro platform are protected from changes from normal users on the public platform
2. Add integration tests for selecting images, with some of them on protected images (similar tests to those added in fix: refactor protection of data imported from producers #8274 )
3. Add protection for images for normal users

[stephanegigandet]

Precision: protecting images means that users should not be able to select a new image (for product front photo, or ingredients, or nutrition, in a specific language), if there is already a photo selected by the producer.

Users are still able to upload new images (but they won't be selected and shown).