CORE-232: move TOS admin enforcement to route level

[davidangb]

Ticket: https://broadworkbench.atlassian.net/browse/CORE-232

What:

Slightly refactors TOS routes/service such that admin permissions are enforced at the route layer instead of the service layer.

As a welcome side effect, this fixes the GET /api/admin/v1/user/email/{email}/supportSummary API. Before this PR, that API claimed to require resource_type_admin support permissions, but in reality it also required admin permissions, since it called the TOS methods in question.

---

PR checklist

• I've followed the instructions if I've made any changes to the API, especially if they're breaking changes
• I've filled out the Security Risk Assessment (requires Broad Internal network access) and attached the result to the JIRA ticket

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
50.0% Duplication on New Code

See analysis details on SonarQube Cloud