Implement Hitobito event access control

This is a shared access control flow, used by multiple endpoints, to check whether a user has access to a Hitobito event they are trying to access.

## Implementation
1. Retrieve event participations from the Hitobito API, filtering by the specified event id, and the user id
```
GET /api/event_participations
?include=roles
&filter[participant_id][eq]=
&filter[event_id][eq]=
&fields[event_participations]=active
&fields[event_roles]=type
```
Example Response:
```jsonc
{
"data": [
{
"id": "16904",
"type": "event_participations",
"attributes": {
"active": true
},
"relationships": {
// ...
"roles": {
"data": [
{
"type": "event_roles",
"id": "17996"
}
]
}
}
}
],
"included": [
{
"id": "17996",
"type": "event_roles",
"attributes": {
"type": "Event::Camp::Role::Leader"
},
"relationships": {
"participation": {
"meta": {
"included": false
}
}
}
}
],
"links": { /* ... */ },
"meta": {}
}
```
2. Make sure that **one of** the included roles has one of the following `attributes.type`
- `Event::Camp::Role::Leader`
- `Event::Role::Leader`
- `Event::Course::Role::Leader`
3. If no event / event participations are found, respond with `404 Not Found`
4. If an event is found but the role is not present or the participation has `active = false`, respond with `403 Forbidden`

> Implementation Note: Make sure that the role that identifies a user as a leader of an event (for MiData `Event::Camp::Role::Leader`) is configurable per different Hitobito provider, so that new supported instances (i.e. CeviDB) can be easily added in the future.
> Defined roles should be shared with https://github.com/ecamp/ecamp3/issues/10386