Bug 40684: Adjust permissions for vendors

The acquisition config route should be accessible to users
with at least one acquisition subpermission or erm permission.

The list vendors route should be accessible to users with the erm
permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Matt Blenkinsop <matt.blenkinsop@openfifth.co.uk>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

api/v1/swagger/paths/acquisitions_vendors.yaml

@@ -78,9 +78,10 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        acquisition:
-          - vendors_manage
-          - marc_order_manage
+        - acquisition:
+            - vendors_manage
+            - marc_order_manage
+        - erm: 1
   post:
     x-mojo-to: Acquisitions::Vendors#add
     operationId: addVendor

api/v1/swagger/paths/acquisitions_vendors_config.yaml

@@ -35,4 +35,5 @@
           $ref: "../swagger.yaml#/definitions/error"
     x-koha-authorization:
       permissions:
-        acquisition: 1
+        - acquisition: '*'
+        - erm: 1