PM-5065 - allow projectIds[] param for fetching challenges

[vas3a]

This pull request adds support for filtering challenges by multiple project IDs in the API and updates the access control logic to treat such queries as having project manager access (with the expectation that only accessible project IDs are provided). The changes update the API documentation, validation schema, query filtering logic, and authorization handling.

API and Filtering Enhancements:

• Added a new projectIds query parameter to the API, allowing clients to filter challenges by multiple project IDs. The parameter is documented as an array using repeated query params (e.g., projectIds[]=1&projectIds[]=2) in docs/swagger.yaml.
• Updated the validation schema in searchChallenges.schema to accept an array of positive integers for the new projectIds filter.
• Enhanced the challenge search logic in ChallengeService.js to apply an IN filter when projectIds is specified, enabling efficient filtering by multiple projects.

Authorization Logic:

• Modified the access control logic to treat searches with multiple projectIds as having project manager access, under the assumption that the caller only passes project IDs they are authorized to access.