This patch implements the check of the ownership of the case by the
connected submitter account. If the user dont have access to the
particular submission, a 403 will be returned. This function is cached
for 15 minutes in the Redis cache.

file_type not passed to the submission_file_set_note() function

The deletion is not possible at the moment if the user has been created,
i.e. after the upload of the consent form. A notification of removal
would be possible, but not implemented at the moment.