sanitize PUT /projects input to prevent field injection

[shreeyaadhikari]

ℹ️ Issue

Closes #220

📝 Description

The PUT /projects/{id} endpoint was passing the entire request body directly to the database update, allowing to overwrite protected columns. Now only safe fields can be updated.
Changes made:

1. Added an updateValues whitelist object in the PUT handler that only allows name, description, total_budget, currency, start_date, and end_date to be updated in handler.ts
2. Added a test that verifies sending project_id and created_at in the request body does not change those values in the database in crud.test.ts

✔️ Verification

Ran the test created in crud.test.ts

1. Protected fields get ignored when a valid field is also sent:

2. Only protected fields get rejected entirely: