fix: Block direct OOO status bypass via PATCH endpoint

[Dhirenderchoudhary]

Description:

• Summary
  Users were able to bypass the OOO request approval flow by directly setting their status to "OOO" via by PATCH /users/status/self and PATCH /users/status/:userid endpoint. This fix closes that loophole by restricting which fields can be updated through the self endpoint.

• Problem
  The PATCH /users/status/self and PATCH /users/status/:userid endpoint allowed users to directly update their currentStatus.state to "OOO" without going through the proper OOO request and approval workflow. This undermined the intended flow where OOO status should only be set through the designated OOO request process.