Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b7bd25885e)
Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>

api/v1/swagger/paths/acquisitions_vendors.yaml

@@ -78,9 +78,10 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        acquisition:
-          - vendors_manage
-          - marc_order_manage
+        - acquisition:
+            - vendors_manage
+            - marc_order_manage
+        - erm: 1
   post:
     x-mojo-to: Acquisitions::Vendors#add
     operationId: addVendor

api/v1/swagger/paths/acquisitions_vendors_config.yaml

@@ -35,4 +35,5 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        acquisition: 1
+        - acquisition: '*'
+        - erm: 1