Restrict UpdateWorkerActivity to ponos auth

Refs https://redmine.teklia.com/issues/3228

Once ponos delegated auth is available, we should limit the UpdateWorkerActivity to only authorize ponos authentication.

A normal API user (through a user token) should not be able to update any worker activity.