[danjhd]

Issue #, if available:
Upstream: bbc/tams#243 (fixes bbc/tams#242)

Description of changes:
Brings main into line with bbc/tams main at 16c1db0. The only API change since the 8.2 tag is bbc/tams#243, which adds dedicated endpoints for the Flow status property. Until now status could only be changed by PUTting the whole Flow.

New endpoints: /flows/{flowId}/status

Method	Responses
HEAD	200, 404
GET	200 (JSON string, e.g. "closed_complete"), 404
PUT	204, 400 (not a valid flow-status value), 403 (Flow is read-only), 404
DELETE	204, 403 (Flow is read-only), 404

Writes publish a flows/updated event, as the other Flow property endpoints do.

Changes

• functions/api_flows/app.py: HEAD/GET/PUT/DELETE handlers, following the label / max_bit_rate pattern. The PUT body is validated against the Flowstatus enum.
• template.yaml: API Gateway events for the 4 routes.
• functions/lambda_authorizer/oauth_scopes.json: read for HEAD/GET, write for PUT/DELETE.
• api/build/openapi.yaml: regenerated from the upstream spec.
• api/TAMS_UPSTREAM_SHA: moved from 34fb31b (8.2) to 16c1db0.

Tests

• Acceptance: 200/404 for HEAD/GET; 204 create/update, 400 (malformed JSON and invalid status), 403 read-only and 404 for PUT; 204, 403 and 404 for DELETE. Also added to the 401 and scope-denied route lists.
• Functional: status added to the body type validation cases.
• All suites pass: unit (226), functional (191) and acceptance, run against a deployed stack.

Not included

• No API version change; upstream still reports 8.2.
• The other upstream changes since 8.2 (ADR0051 and GOVERNANCE.md, about the host organisation) don't affect the implementation.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.