api: allow non maintainers to update only attention set

Author: DATVenancio

patchwork/api/patch.py

@@ -427,6 +427,14 @@ def partial_update(self, request, *args, **kwargs):
             obj.project in request.user.profile.maintainer_projects.all()
             or request.user.is_superuser
         )
+        non_attention_set_keys = [
+            key for key in request.data if key != 'attention_set'
+        ]
+
+        if non_attention_set_keys and not is_maintainer:
+            raise PermissionDenied(
+                detail='You do not have permission to edit patch properties.'
+            )
 
         if 'attention_set' in request.data and request.method in ('PATCH',):
             attention_set = request.data.get('attention_set', None)