spp_api_v2 / spp_dci_server: the Require consent checkbox no longer matches how consent is decided #579

Problem

After #555, spp_api_v2 decides consent from the API client's legal basis only (ConsentService.is_consent_filtered), on reads, not-found answers and check_access. It no longer reads is_require_consent anywhere.

The Require consent checkbox is still on the API client form, though, and can be set independently of the legal basis. An administrator who ticks it on a public_task client, or unticks it on a consent client, sees a setting that has no effect on the REST API.

spp_dci_server's consent adapter still reads is_require_consent, so the same two settings can still disagree there.

Expected

The client form should show one source of truth. Options:

• derive is_require_consent from legal_basis (a computed, read-only field), or
• remove it from the form and migrate spp_dci_server to the legal-basis predicate.

Either way, spp_dci_server should use the same NON_CONSENT_BASES list as spp_api_v2. That's the third copy kneckinator flagged in #555, deferred there because #513 bumps spp_dci_server.

Context

Follow-up from the #555 review round (kneckinator's comment on program_membership.py:85).