URL/query/data input lacking validation

Although this Sentry issue ([FLAGSMITH-API-5J6](https://flagsmith.sentry.io/issues/7298473125/?referrer=github_integration)
) is isolated to this one case, we have history of similar errors showing up in Sentry.

The goal of this issue is to:
1. Find occurrences in the code that skip input validation — similar to this — and fix them with a proper HTTP 400 response.
2. Ultimately, reduce noise — again, similar to this.

```
ValueError: invalid literal for int() with base 10: 'PROJECT_ID'
File "django/db/models/fields/__init__.py", line 2128, in get_prep_value
return int(value)

ValueError: Field 'id' expected a number but got 'PROJECT_ID'.
(19 additional frame(s) were not displayed)
...
File "features/permissions.py", line 57, in has_permission
project = Project.objects.get(id=project_id)
```