Add permission check for half-day attendance updates

Half-day attendance mutations now require write permission on Attendance doctype, closing permission bypass in mark_employee_attendance.