Services can add test results in sessions without access to the test type.

[doumdi]

Describe the bug
Services can add test results in sessions without access to the test type.

To Reproduce
POST test results to the /api/service/tests endpoint.

• There is no verification if the session's project has access to the test type.
• A session may not be attached to any project directly, making it hard to verify.
• A test can be created by either (user, device, participant, service), which makes it hard to verify.

Expected behavior
status_code 403 should be returned instead of 200, OK.