Variables - POST/PUT/PATCH CSV variable requests with value of property 'selected' not in values list is not controlled by the server

Nobody has claimed this yet.

__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.

1. create a request to POST a new or PATCH and existing CSV variable
2. for the property `selected` assign a value not in the array `agruments.values`
3. submit the request

__Expected behavior:__
There are other features which rely on the consistency of the `selected` property. For example the UI in preparing dashboards. So, a check of the consistency of a `selected` value actually being in the `argument.values` array would be expected.

__Actual behavior:__
The variable can be created or updated with an inconsistent value for the property `selected`

__example request PATCH body__
```javascript
{
selected: ['Thor'],
arguments: {
type: 'constant',
values: ['Daphne', 'Galatea', 'Thetis', 'Persephone', 'Harmonia']
}
}
```
__response body from request__
```json
{
"id": "0a3c853ece6a3000",
"orgID": "63e23d418425557b",
"name": "metamorphoses",
"description": "generic CSV description",
"selected": [
"Thor"
],
"arguments": {
"type": "constant",
"values": [
"Daphne",
"Galatea",
"Thetis",
"Persephone",
"Harmonia"
]
},
"sort_order": 0,
"createdAt": "2022-11-04T10:02:33.145865032Z",
"updatedAt": "2022-11-04T10:02:33.478904201Z",
"labels": [],
"links": {
"self": "/api/v2/variables/0a3c853ece6a3000",
"labels": "/api/v2/variables/0a3c853ece6a3000/labels",
"org": "/api/v2/orgs/63e23d418425557b"
}
}

```

__Environment info:__

Testing against K8SIDPE remocal

latest commit

```
commit e9b4a39a7a048fdbdd482d117c37e233fdeb6d41 (HEAD -> master, origin/master, origin/HEAD)
Author: Yoofi Quansah
Date: Thu Nov 3 17:22:29 2022 -0700

```

The issue does not name a file or test; start by locating the POST/PUT/PATCH variable request handlers for CSV variables. Reproduce the example with selected set to “Thor”, then add coverage for rejecting values absent from arguments.values and verify valid requests remain accepted.

Written by the indexing model from the issue text.