Fix a bug, which would allow definitions to bechanged via API.
Fix a bug, which would allow definitions to bechanged via API.

No record is ever allowed "change" it's collection, and API writes
only ever allow updates of auth, bib or hold. That _should_ have
been enough to prevent definitions updates, but there's a loop hole.

It turns out that the API makes it's judgement of collection based
on the contents of the update. So you can pass the API something
that looks like, say, a hold and pass the first check. But when
that presumed hold is then saved, there's no check that thing being
overwritten was indeed a hold. So in fact you can update a definition
as long the new data you're updating with doens't look like a
definition. This commit fixes the loophole by also checking that
the record about to be overwritten is in fact auth, bib or hold.

libris/librisxl,libris/librisxl,libris/librisxl