Add project auth checks in external issue creation and deletion

[geoffg-sentry]

After #112605 I went hunting for some other vulnerabilities around external issue linking with some specific criteria for VULN-1434:

• Enforce project-level access and respect open team membership
• Maintain the control/cell boundaries, no redrawing of the silos and keep changes in RPC

Found and fixed some in external issue creation and deletion while passing issueIDs in the same org:

• Refactored _extract_lazy_object since it was private to installation_external_issue_actions
• create_external_issue POST now auth checks with has_project_access, killing an IDOR
• delete_external_issue DELETE does the same, killing another IDOR
• get_select_options called with a projectId could hit other projects you weren't scoped for, hardened

Updated schema in getsentry/sentry-api-schema#66

Now split properly to make User optional in the first merge, followed up by making it a requirement in the next PR. Will be enforced afterward

[markstory]

Looks good to me.