Permission checks in workspace update_page and onboarding step update

Public workspaces can no longer be unpublished by users without roles, and the onboarding step update ignores fields other than skip and complete. Both now have tests.