Add access check for "notes" operation

Please create an MR and lets see if the test pass.

I am not sure we can make this type of access control change without impact existing expectations.

keshav patel → made their first commit to this issue’s fork.

Ported #2 into an MR.

This operation should probably be treated the same as the "resend" operation; i.e. a user may perform that operation if they have the "submission_update_any".

I agree with this assumption. Let's make the improvement.