fix: use employer or same site when doing employer actions

This is a fix for https://freshworks.atlassian.net/browse/HCAP-1308 but serves in two ways:

When posting an employer action, there's a touch less reliance on Employer Id of a status. 1308 was caused when the employer_id was different from the user trying to archive. In participant-status.js, we see the cause:

    const existingCurrentStatus = currentStatusId
      ? await tx[collections.PARTICIPANTS_STATUS].findOne({ id: currentStatusId })
      : await tx[collections.PARTICIPANTS_STATUS].findOne({
          participant_id: participantId,
          current: true,
          employer_id: employerId,
        });

~~That is when no currentStatusId is passed in. By getting the status id first, we not pass it in here properly, but we also check that the accessing user has the right permissions for the participant.~~

We're keeping it at no status passed in, but there's still less reliance on the hiring user being the same person.

bcgov / hcap

fix: use employer or same site when doing employer actions #807