Fix: Enforce permissions check on challenge creation (#4859)

[Kitan-Dara06]

Fixes #4859

Summary

This PR fixes a security vulnerability where users with insufficient permissions (e.g., READ access) or pending invitations could create challenges if they were members of the Host Team.

Changes

• Modified apps/challenges/views.py: Updated create_challenge_using_zip_file to replace the weak membership check (if user in members) with a strict database query.
• Added Status Check: The code now explicitly verifies that the user's membership status is ACCEPTED.
• Added Permission Check: The code now enforces that the user must have ADMIN or WRITE permissions. Users with READ access are now correctly blocked.

Verification

I verified this locally using the Django shell:

1. Created a ChallengeHostTeam.
2. Added a user with permissions=ChallengeHost.READ.
3. Attempted to trigger the creation logic.
4. Result: The user was correctly blocked with a 403 Forbidden error (previously, this user would have been allowed to proceed).

Checklist

• Tested manually in local environment.
• Followed style guidelines.