[permissions] Add permission gates on workspaceMember (#10447)

- Adding permission gates on workspaceMember to only allow user with
admin permissions OR users attempting to update or delete themself to
perform write operations on workspaceMember object
- Reverting some changes to treat workflow objects as regular metadata
objects (any user can interact with them)
- (fix) Block updates on soft deleted records

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/interfaces/base-resolver-service.ts

@@ -1,11 +1,7 @@
 import { Inject, Injectable } from '@nestjs/common';
 
 import graphqlFields from 'graphql-fields';
-import {
-  capitalize,
-  isObjectRecordUnderObjectRecordsPermissions,
-  PermissionsOnAllObjectRecords,
-} from 'twenty-shared';
+import { capitalize, PermissionsOnAllObjectRecords } from 'twenty-shared';
 import { DataSource, ObjectLiteral } from 'typeorm';
 
 import { ObjectRecord } from 'src/engine/api/graphql/workspace-query-builder/interfaces/object-record.interface';
@@ -103,12 +99,9 @@ export abstract class GraphqlQueryBaseResolverService<
 
       if (
         featureFlagsMap[FeatureFlagKey.IsPermissionsEnabled] &&
-        isObjectRecordUnderObjectRecordsPermissions({
-          isCustom: objectMetadataItemWithFieldMaps.isCustom,
-          nameSingular: objectMetadataItemWithFieldMaps.nameSingular,
-        })
+        !objectMetadataItemWithFieldMaps.isSystem
       ) {
-        await this.validateCustomObjectPermissionsOrThrow({
+        await this.validateObjectRecordPermissionsOrThrow({
           operationName,
           options,
         });
@@ -230,7 +223,7 @@ export abstract class GraphqlQueryBaseResolverService<
     }
   }
 
-  private async validateCustomObjectPermissionsOrThrow({
+  private async validateObjectRecordPermissionsOrThrow({
     operationName,
     options,
   }: {