System segments can be overwritten via the change request API

[gagantrivedi]

Bug

ProjectChangeRequestSerializer (workflows_logic) accepts nested segment drafts with a writable version_of, and nothing validates the target segment. On commit, _publish_segments (api/core/workflows_services.py) copies the draft's name, description and rules onto the live segment. SegmentViewSet's is_system_segment=False queryset filter never applies on this path — the draft is created by the change request API, not the segments API.

Reproduction

1. Create a project change request with a nested segment whose version_of is a system segment's id (e.g. an experimentation rollout segment).
2. Approve and commit the change request.
3. The live system segment's name and rules are overwritten.

Impact

System segments — including experimentation rollout segments, whose conditions control experiment percentage splits — can be modified through the change request flow, which the is_system_segment mechanism is meant to prevent.