Enforce order of permissions decorators

At the moment we mostly have `user_has_permissions` execute first. It
shouldn’t matter, but it feels right for us to check that a user is
logged in before we check their permissions to a service. Otherwise a
malicious user could (maybe) check if a service ID belongs to a real
service, and go on to do something malicious with that information.

This commit adds some extra test code to enforce that the order is
always the same.

N.B. decorators in Python execute from closest to furthest (from the
line on which the function is defined).

app/main/views/platform_admin.py

@@ -339,8 +339,8 @@ def platform_admin_letter_validation_preview():
 
 
 @main.route("/services/<service_id>/letter-validation-preview", methods=["GET", "POST"])
-@login_required
 @user_has_permissions()
+@login_required
 def service_letter_validation_preview(service_id):
     return letter_validation_preview(from_platform_admin=False)