fix: enable API key management of workspace views + fix permission bypass vulnerability (#16768)

Fixes #16739

- Remove empty string coercion in createCoreView that caused PostgreSQL
UUID errors for API keys
- Add permission check allowing API keys with VIEWS permission to manage
workspace views they created

API keys with 'Manage Views' permission can now create, update, and
delete workspace views via both GraphQL and REST APIs.

packages/twenty-server/src/engine/metadata-modules/view/resolvers/view.resolver.ts

@@ -153,7 +153,7 @@ export class ViewResolver {
     return await this.viewService.createOne({
       createViewInput: input,
       workspaceId: workspace.id,
-      createdByUserWorkspaceId: userWorkspaceId ?? '',
+      createdByUserWorkspaceId: userWorkspaceId,
     });
   }