Validate only the submitted fields on update

[ramonski]

Description of the issue/feature this PR addresses

update_object_with_data re-validates the whole object after applying the record. The field managers already validate each submitted field on set, so this second pass only re-checks fields the caller never touched, and it fails when one of them no longer passes a full validation: an Archetypes field holding a stored legacy value, or a Dexterity behavior invariant such as IExcludeFromNavigationDefault. In practice this blocks partial updates to setup objects (for example toggling a single bika_setup flag, or setting a Sample's Specification), even though the submitted field itself is valid.

This skips the redundant whole-object validation on the update route. Each submitted field is still validated on set (so invalid input is still rejected), while creation keeps validating the full object, preserving the behavior added in #66.

Current behavior before PR

A partial update (POST update/<uid> with a single field) runs a full-object validation and can return 400 with errors for untouched fields, or fail on a behavior invariant.

Desired behavior after PR is merged

The update only validates the fields that were submitted; unrelated untouched fields are left alone. Submitting an invalid field is still rejected. Covered by a new Partial validation on update section in update.rst.

--
I confirm I have coded it according to PEP8 standards.

[ramonski]

Rebased onto the current 2.x, and the change had to be rewritten rather than replayed.

When this branch was first written, update_items and update_object_with_data still lived in senaite/jsonapi/api/__init__.py. #97 moved them to api/mutation.py, so the original commit no longer applied anywhere. The same change now sits in mutation.py: update_object_with_data takes a partial flag, the two call sites on the update route pass partial=True, and create_object keeps the full validation.

One thing is new since the commit was written. 2.x now skips the whole-object validation for a custom IUpdate adapter, because such an adapter assembles the object through domain operations. That branch is untouched here; the flag only applies to the field-manager path below it.

The branch also carried the commit of #106, which is on 2.x now. It is dropped, so the diff is this change alone.

bin/test-senaite -s senaite.jsonapi: 38 tests, 0 failures, 0 errors.