Ensure all service route have permission decorators

We accidentally miss these sometimes. This code adds a test which
inspects the code to automatically check that any function which:
- handles a route
- accepts a service_id

For each function it checks that each of these routes have the
permissions decorator we’d expect.

Most of the introspection/AST code is adapted from here:
https://mvdwoord.github.io/exploration/2017/08/18/ast_explore.html

app/main/views/manage_users.py

@@ -269,6 +269,7 @@ def confirm_edit_user_mobile_number(service_id, user_id):
 
 @main.route("/services/<service_id>/cancel-invited-user/<uuid:invited_user_id>", methods=['GET'])
 @user_has_permissions('manage_service')
+@login_required
 def cancel_invited_user(service_id, invited_user_id):
     current_service.cancel_invite(invited_user_id)