Move the validation and creation code from WorkerConfigurationList to WorkerConfigurationListSerializer

According to the freshly-printed best practices, overriding the generic methods on generic API views, such as CreateAPIView.create, is a bad idea. The validation code should be moved to the serializer, in WorkerConfigurationListSerializer.validate.

The worker retrieval and permission checking can be done in a cached property, which can be used for both get_queryset and get_serializer_context; this deduplicates the rights checks and lets the serializer get access to the worker.