[Controller] Port "collection update" functional tests from Rails API to controller test suite
- Rails functional tests
- Rails integration tests
- Some permission checks from the Rails unit tests ("only admin can do xyz")
We don't need to port all of the unit tests -- most of that should wait until we know what the units look like in Go. Focus on proper API request handling more than the underlying collection model behavior.
Since these APIs are (for now) implemented by proxying to Rails, the test can't rely on rolling back an entire-test transaction to avoid side effects. (It should be enough to call the "database reset" API in test teardown.)