prevent mass assignment and IDOR in task and routine updates

[Abhishek2005-ard]

Summary

This PR addresses security vulnerabilities (Mass Assignment and IDOR) within the Task and Routine update/creation controllers:

1. Mass Assignment: Strips unallowed or sensitive properties (like userId and _id) from request payloads prior to updating Tasks and Routines.
2. IDOR: Ensures that when creating or updating a Routine, all referenced task IDs belong to the authenticated user.

Changes

• Task Controller (taskController.js):
  • Sanitized inputs in updateTask to only permit defined, non-sensitive keys (title, description, tags, priority, status, dueDate, actualDuration).
• Routine Controller (routineController.js):
  • Sanitized inputs in updateRoutine to only permit name, description, and items.
  • Added verification checks in both createRoutine and updateRoutine to validate that all referenced task IDs in items are owned by the current user.
  • Imported the Task model to support validation.

Testing & Verification

• Created mock unit tests to confirm:
  • Updates containing forbidden keys (userId, _id, createdAt) are stripped of those keys.
  • Tasks belonging to another user referenced in a routine are rejected with a 400 Bad Request error.
• Verified syntax consistency with npm run lint.

close #1651