fix: Block updates on expired events [DHIS2-21536]

[enricocolasante]

Summary

Fixes a gap in event date validation where completed events past their expiry window could
still be updated. The expiry check now anchors to the persisted completion date
when an event is already completed in the database, so updates are correctly blocked even when
the payload omits completedAt or status, and a fresh completedAt in the payload can no
longer reset the expiry clock.

Changes

• DateValidator.java: Reworks validateCompletionExpiryDays to use the program's
  completeEventsExpiryDays as the early-return guard and to resolve the completion date the
  expiry check is anchored to via the new getCompletedDate / getPersistedCompletedDate
  helpers (which read the persisted event from TrackerPreheat). When the event is already
  completed in the DB, the persisted completion date wins over any value in the payload;
  otherwise, if the payload itself completes the event, its completedAt is used.
• DateValidator.java: Threads TrackerPreheat into the validation so both TrackerEvent and
  SingleEvent types can look up their persisted counterparts.
• DateValidatorTest.java: Adds coverage for the new behavior — expiry failures when the
  payload lacks completedAt/status, payload completedAt not resetting the clock on an
  already-completed event, passing within the expiry window, and the F_EDIT_EXPIRED
  authorization bypass; for both TrackerEvent and SingleEvent.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud