Reduce permitted attributes for cart update

[adammathys]

Summary

The storefront cart controller was using the permitted_order_attributes which allow for editing address, delivery, payment, confirm, and line item attributes. However, the cart endpoint is only actively used to update line item quantities.

Furthermore, some of the attributes that it permits aren't actually usable by this endpoint. For example, passing payment attributes is entirely useless outside of creating new check payments. All other payment methods require a source and it's not possible to pass through source_attributes in this method because it doesn't make use of the PaymentCreate object that handles setting up the source from the attributes. (And you can't modify existing payments because ID is not a valid attribute.)

The only allowed attributes moving forward are:

• Customer metadata
• Email (our specs establish this as a valid attribute, so I've left it in.)
• Line item attributes (the primary use-case)

If an app still needs or wants to use the cart controller for updating other attributes, they can easily add more to the permitted_cart_attributes method.

Checklist

Check out our PR guidelines for more details.

The following are mandatory for all PRs:

• I agree that my PR will be published under the same license as Solidus.
• I have written a thorough PR description.
• I have kept my commits small and atomic.
• I have localized any and all user-facing strings that I added to the source code.
• I have used clear, explanatory commit messages.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.33%. Comparing base (319f1a2) to head (1030aaa).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6636   +/-   ##
=======================================
  Coverage   92.33%   92.33%           
=======================================
  Files        1050     1050           
  Lines       21367    21369    +2     
=======================================
+ Hits        19729    19731    +2     
  Misses       1638     1638           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.