Bug 35468: (follow-up) Test only the specific permission needed

Bug 35468: (follow-up) Test only the specific permission needed

The tests were granting circulation top-level permissions - we should be able to
perform the actions with only 'manage_bookings'. This patch updates the tests to
use the narrower permission.

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
(cherry picked from commit a2005cd32c99f92d5eb2d25b181f7be79f50b90c)
Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>